About YARA Rules
YARA is a tool developed at VirusTotal, primarily aimed at helping malware researchers to identify and classify malware samples. It matches based on rules specified by the user containing textual or binary patterns and a boolean expression. For help on writing rules, see the YARA documentation.
Input: binary bytes (text input uses UTF-8; a file retains its original bytes). Output: text.
Format reference: YARA Rules background and specification
Example
Use “Try example” to load this public sample and its settings, then run it.
Settings used in this example
| Parameter | Example value | Input and choices |
|---|---|---|
| Rules | "import \"hash\"\n rule HelloWorldMD5 {\n condition:\n hash.md5(0,filesize) == \"ed076287532e86365e841e92bfc50d8c\"\n }\n\n rule HelloWorldSHA256 {\n condition:\n hash.sha256(0,filesize) == \"7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069\"\n }" | Text |
| Show strings | true | On or off |
| Show string lengths | true | On or off |
| Show metadata | true | On or off |
| Show counts | true | On or off |
| Show rule warnings | false | On or off |
| Show console module messages | false | On or off |
Input
Hello World!
Result
Input matches rule "HelloWorldMD5". Input matches rule "HelloWorldSHA256".
Parameters
| Parameter | Default value | Input and choices |
|---|---|---|
| Rules | "" | Text |
| Show strings | false | On or off |
| Show string lengths | false | On or off |
| Show metadata | false | On or off |
| Show counts | true | On or off |
| Show rule warnings | true | On or off |
| Show console module messages | true | On or off |
Before interpreting the result
File signatures and heuristics are clues, not definitive classification. Retain an original copy and compare exact bytes when investigating a file. A parser failure can also indicate truncated or unsupported data.
How to use this page
- Paste your input or open a local file.
- Adjust tool options if needed, then choose Run tool.
- Copy the result or download the original output bytes.
Inputs and results are not added to the public catalogue or saved in the URL. Processing happens in your browser; HTTP Request and DNS over HTTPS send the requests you explicitly run. Files up to 128 MiB can be opened; decompression and image tools may have smaller processing limits. Large results have a shortened preview. Text and HTML downloads use UTF-8; binary downloads preserve output bytes. Pasted text follows browser newline handling; open a file when exact input bytes matter.