CRC32_poly_0x6b6b51f4__32_big_refl_True_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CRC32_poly_0x6b6b51f4__32_big_refl_True_ (No description metadata provided).

rule CRC32_poly_0x6b6b51f4__32_big_refl_True_ {
  strings:
    $a0 = { 00 00 00 00 0d c8 01 19 1b 90 02 32 16 58 03 2b 37 20 04 64 3a e8 05 7d 2c b0 06 56 21 78 07 4f 31 55 a5 65 3c 9d a4 7c 2a c5 a7 57 27 0d a6 4e 06 75 a1 01 0b bd a0 18 1d e5 a3 33 10 2d a2 2a 3d be e7 67 30 76 e6 7e 26 2e e5 55 2b e6 e4 4c 0a 9e e3 03 07 56 e2 1a 11 0e e1 31 1c c6 e0 28 0c eb 42 02 01 23 43 1b 17 7b 40 30 1a b3 41 29 3b cb 46 66 36 03 47 7f 20 5b 44 54 2d 93 45 4d 24 68 63 63 29 a0 62 7a 3f f8 61 51 32 30 60 48 13 48 67 07 1e 80 66 1e 08 d8 65 35 05 10 64 2c 15 3d c6 06 18 f5 c7 1f 0e ad c4 34 03 65 c5 2d 22 1d c2 62 2f d5 c3 7b 39 8d c0 50 34 45 c1 49 19 d6 84 04 14 1e 85 1d 02 46 86 36 0f 8e 87 2f 2e f6 80 60 23 3e 81 79 35 66 82 52 38 ae 83 4b 28 83 21 61 25 4b 20 78 33 13 23 53 3e db 22 4a 1f a3 25 05 12 6b 24 1c 04 33 27 37 09 fb 26 2e 17 c5 6b 6b 1a 0d 6a 72 0c 55 69 59 01 9d 68 40 20 e5 6f 0f 2d 2d 6e 16 3b 75 6d 3d 36 bd 6c 24 26 90 ce 0e 2b 58 cf 17 3d 00 cc 3c 30 c8 cd 25 11 b0 ca 6a 1c 78 cb 73 0a 20 c8 58 07 e8 c9 41 2a 7b 8c 0c 27 b3 8d 15 31 eb 8e 3e 3c 23 8f 27 1d 5b 88 68 10 93 89 71 06 cb 8a 5a 0b 03 8b 43 1b 2e 29 69 16 e6 28 70 00 be 2b 5b 0d 76 2a 42 2c 0e 2d 0d 21 c6 2c 14 37 9e 2f 3f 3a 56 2e 26 33 ad 08 08 3e 65 09 11 28 3d 0a 3a 25 f5 0b 23 04 8d 0c 6c 09 45 0d 75 1f 1d 0e 5e 12 d5 0f 47 02 f8 ad 6d 0f 30 ac 74 19 68 af 5f 14 a0 ae 46 35 d8 a9 09 38 10 a8 10 2e 48 ab 3b 23 80 aa 22 0e 13 ef 6f 03 db ee 76 15 83 ed 5d 18 4b ec 44 39 33 eb 0b 34 fb ea 12 22 a3 e9 39 2f 6b e8 20 3f 46 4a 0a 32 8e 4b 13 24 d6 48 38 29 1e 49 21 08 66 4e 6e 05 ae 4f 77 13 f6 4c 5c 1e 3e 4d 45 2f 8a d6 d6 22 42 d7 cf 34 1a d4 e4 39 d2 d5 fd 18 aa d2 b2 15 62 d3 ab 03 3a d0 80 0e f2 d1 99 1e df 73 b3 13 17 72 aa 05 4f 71 81 08 87 70 98 29 ff 77 d7 24 37 76 ce 32 6f 75 e5 3f a7 74 fc 12 34 31 b1 1f fc 30 a8 09 a4 33 83 04 6c 32 9a 25 14 35 d5 28 dc 34 cc 3e 84 37 e7 33 4c 36 fe 23 61 94 d4 2e a9 95 cd 38 f1 96 e6 35 39 97 ff 14 41 90 b0 19 89 91 a9 0f d1 92 82 02 19 93 9b 0b e2 b5 b5 06 2a b4 ac 10 72 b7 87 1d ba b6 9e 3c c2 b1 d1 31 0a b0 c8 27 52 b3 e3 2a 9a b2 fa 3a b7 10 d0 37 7f 11 c9 21 27 12 e2 2c ef 13 fb 0d 97 14 b4 00 5f 15 ad 16 07 16 86 1b cf 17 9f 36 5c 52 d2 3b 94 53 cb 2d cc 50 e0 20 04 51 f9 01 7c 56 b6 0c b4 57 af 1a ec 54 84 17 24 55 9d 07 09 f7 b7 0a c1 f6 ae 1c 99 f5 85 11 51 f4 9c 30 29 f3 d3 3d e1 f2 ca 2b b9 f1 e1 26 71 f0 f8 38 4f bd bd 35 87 bc a4 23 df bf 8f 2e 17 be 96 0f 6f b9 d9 02 a7 b8 c0 14 ff bb eb 19 37 ba f2 09 1a 18 d8 04 d2 19 c1 12 8a 1a ea 1f 42 1b f3 3e 3a 1c bc 33 f2 1d a5 25 aa 1e 8e 28 62 1f 97 05 f1 5a da 08 39 5b c3 1e 61 58 e8 13 a9 59 f1 32 d1 5e be 3f 19 5f a7 29 41 5c 8c 24 89 5d 95 34 a4 ff bf 39 6c fe a6 2f 34 fd 8d 22 fc fc 94 03 84 fb db 0e 4c fa c2 18 14 f9 e9 15 dc f8 f0 1c 27 de de 11 ef df c7 07 b7 dc ec 0a 7f dd f5 2b 07 da ba 26 cf db a3 30 97 d8 88 3d 5f d9 91 2d 72 7b bb 20 ba 7a a2 36 e2 79 89 3b 2a 78 90 1a 52 7f df 17 9a 7e c6 01 c2 7d ed 0c 0a 7c f4 21 99 39 b9 2c 51 38 a0 3a 09 3b 8b 37 c1 3a 92 16 b9 3d dd 1b 71 3c c4 0d 29 3f ef 00 e1 3e f6 10 cc 9c dc 1d 04 9d c5 0b 5c 9e ee 06 94 9f f7 27 ec 98 b8 2a 24 99 a1 3c 7c 9a 8a 31 b4 9b 93 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9831902a-4880-4e14-9dc4-208610d6ecf0

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion