Blowfish_ks2_table__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule Blowfish_ks2_table__32_big_1024_ (No description metadata provided).

rule Blowfish_ks2_table__32_big_1024_ {
  strings:
    $a0 = { e9 3d 5a 68 94 81 40 f7 f6 4c 26 1c 94 69 29 34 41 15 20 f7 76 02 d4 f7 bc f4 6b 2e d4 a2 00 68 d4 08 24 71 33 20 f4 6a 43 b7 d4 b7 50 00 61 af 1e 39 f6 2e 97 24 45 46 14 21 4f 74 bf 8b 88 40 4d 95 fc 1d 96 b5 91 af 70 f4 dd d3 66 a0 2f 45 bf bc 09 ec 03 bd 97 85 7f ac 6d d0 31 cb 85 04 96 eb 27 b3 55 fd 39 41 da 25 47 e6 ab ca 0a 9a 28 50 78 25 53 04 29 f4 0a 2c 86 da e9 b6 6d fb 68 dc 14 62 d7 48 69 00 68 0e c0 a4 27 a1 8d ee 4f 3f fe a2 e8 87 ad 8c b5 8c e0 06 7a f4 d6 b6 aa ce 1e 7c d3 37 5f ec ce 78 a3 99 40 6b 2a 42 20 fe 9e 35 d9 f3 85 b9 ee 39 d7 ab 3b 12 4e 8b 1d c9 fa f7 4b 6d 18 56 26 a3 66 31 ea e3 97 b2 3a 6e fa 74 dd 5b 43 32 68 41 e7 f7 ca 78 20 fb fb 0a f5 4e d8 fe b3 97 45 40 56 ac ba 48 95 27 55 53 3a 3a 20 83 8d 87 fe 6b a9 b7 d0 96 95 4b 55 a8 67 bc a1 15 9a 58 cc a9 29 63 99 e1 db 33 a6 2a 4a 56 3f 31 25 f9 5e f4 7e 1c 90 29 31 7c fd f8 e8 02 04 27 2f 70 80 bb 15 5c 05 28 2c e3 95 c1 15 48 e4 c6 6d 22 48 c1 13 3f c7 0f 86 dc 07 f9 c9 ee 41 04 1f 0f 40 47 79 a4 5d 88 6e 17 32 5f 51 eb d5 9b c0 d1 f2 bc c1 8f 41 11 35 64 25 7b 78 34 60 2a 9c 60 df f8 e8 a3 1f 63 6c 1b 0e 12 b4 c2 02 e1 32 9e af 66 4f d1 ca d1 81 15 6b 23 95 e0 33 3e 92 e1 3b 24 0b 62 ee be b9 22 85 b2 a2 0e e6 ba 0d 99 de 72 0c 8c 2d a2 f7 28 d0 12 78 45 95 b7 94 fd 64 7d 08 62 e7 cc f5 f0 54 49 a3 6f 87 7d 48 fa c3 9d fd 27 f3 3e 8d 1e 0a 47 63 41 99 2e ff 74 3a 6f 6e ab f4 f8 fd 37 a8 12 dc 60 a1 eb dd f8 99 1b e1 4c db 6e 6b 0d c6 7b 55 10 6d 67 2c 37 27 65 d4 3b dc d0 e8 04 f1 29 0d c7 cc 00 ff a3 b5 39 0f 92 69 0f ed 0b 66 7b 9f fb ce db 7d 9c a0 91 cf 0b d9 15 5e a3 bb 13 2f 88 51 5b ad 24 7b 94 79 bf 76 3b d6 eb 37 39 2e b3 cc 11 59 79 80 26 e2 97 f4 2e 31 2d 68 42 ad a7 c6 6a 2b 3b 12 75 4c cc 78 2e f1 1c 6a 12 42 37 b7 92 51 e7 06 a1 bb e6 4b fb 63 50 1a 6b 10 18 11 ca ed fa 3d 25 bd d8 e2 e1 c3 c9 44 42 16 59 0a 12 13 86 d9 0c ec 6e d5 ab ea 2a 64 af 67 4e da 86 a8 5f be bf e9 88 64 e4 c3 fe 9d bc 80 57 f0 f7 c0 86 60 78 7b f8 60 03 60 4d d1 fd 83 46 f6 38 1f b0 77 45 ae 04 d7 36 fc cc 83 42 6b 33 f0 1e ab 71 b0 80 41 87 3c 00 5e 5f 77 a0 57 be bd e8 ae 24 55 46 42 99 bf 58 2e 61 4e 58 f4 8f f2 dd fd a2 f4 74 ef 38 87 89 bd c2 53 66 f9 c3 c8 b3 8e 74 b4 75 f2 55 46 fc d9 b9 7a eb 26 61 8b 1d df 84 84 6a 0e 79 91 5f 95 e2 46 6e 59 8e 20 b4 57 70 8c d5 55 91 c9 02 de 4c b9 0b ac e1 bb 82 05 d0 11 a8 62 48 75 74 a9 9e b7 7f 19 b6 e0 a9 dc 09 66 2d 09 a1 c4 32 46 33 e8 5a 1f 02 09 f0 be 8c 4a 99 a0 25 1d 6e fe 10 1a b9 3d 1d 0b a5 a4 df a1 86 f2 0f 28 68 f1 69 dc b7 da 83 57 39 06 fe a1 e2 ce 9b 4f cd 7f 52 50 11 5e 01 a7 06 83 fa a0 02 b5 c4 0d e6 d0 27 9a f8 8c 27 77 3f 86 41 c3 60 4c 06 61 a8 06 b5 f0 17 7a 28 c0 f5 86 e0 00 60 58 aa 30 dc 7d 62 11 e6 9e d7 23 38 ea 63 53 c2 dd 94 c2 c2 16 34 bb cb ee 56 90 bc b6 de eb fc 7d a1 ce 59 1d 76 6f 05 e4 09 4b 7c 01 88 39 72 0a 3d 7c 92 7c 24 86 e3 72 5f 72 4d 9d b9 1a c1 5b b4 d3 9e b8 fc ed 54 55 78 08 fc a5 b5 d8 3d 7c d3 4d ad 0f c4 1e 50 ef 5e b1 61 e6 f8 a2 85 14 d9 6c 51 13 3c 6f d5 c7 e7 56 e1 4e c4 36 2a bf ce dd c6 c8 37 d7 9a 32 34 92 63 82 12 67 0e fa 8e 40 60 00 e0 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

cf81675f-dad9-449a-a91e-42615e29f1d8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion