{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/gettingstarted.rst",
    "https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/commandline.rst",
    "https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/modules/pe.rst",
    "https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/modules/elf.rst",
    "https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/modules/math.rst",
    "https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/docs/modules/cuckoo.rst",
    "https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/COPYING",
    "https://github.com/VirusTotal/yara/releases/tag/v4.6.0",
    "https://github.com/VirusTotal/yara-x/blob/1bda5fc3cbd05c937bcedc63a662f513b7490c4d/README.md",
    "https://virustotal.github.io/yara-x/blog/yara-x-is-stable/"
  ],
  "category": "native-analysis",
  "description_en": "VirusTotal's pattern-matching tool for identifying and classifying files such as malware samples with rules that combine text, hex and regular-expression strings with a Boolean condition. It scans a file, a folder or a running process from the command line, through the libyara C API or from Python with yara-python. Modules expose parsed structure to rules: pe and elf expose most fields of PE and ELF headers, dotnet adds .NET metadata, math adds calculations such as entropy, and the optional magic and cuckoo modules add libmagic file types and Cuckoo sandbox behavior reports.",
  "description_zh": "VirusTotal 推出的模式匹配工具，用规则识别和归类恶意软件样本等文件；每条规则由文本、十六进制和正则表达式字符串加一个布尔条件组成。可通过命令行、libyara C API 或 Python 扩展 yara-python 扫描单个文件、文件夹或运行中的进程。各模块向规则提供解析后的结构信息：pe 和 elf 模块提供 PE 与 ELF 头部的大部分字段，dotnet 模块提供 .NET 元数据，math 模块提供熵等计算，可选的 magic 和 cuckoo 模块则提供 libmagic 文件类型和 Cuckoo 沙箱行为报告数据。",
  "entry_url": "https://awesomerea.org/resources/yara/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/yara/",
  "evidence_url": "https://github.com/VirusTotal/yara/blob/6d47342e825e59f5d8f20874d0778332bcec83a6/README.md",
  "group": "tools",
  "id": "yara",
  "json_url": "https://awesomerea.org/resources/yara/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/yara/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/yara/index.md",
  "name": "YARA",
  "name_zh": "YARA 文件模式匹配与分类工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "limits",
    "license"
  ],
  "requirements": [
    "Runs on Windows, Linux and macOS; release at review: v4.6.0, published 2026-10-27. Source builds need automake, libtool, make, gcc and pkg-config. Features that depend on OpenSSL are enabled only when OpenSSL is installed, and the cuckoo (Jansson) and magic (libmagic) modules are compiled only with --enable-cuckoo or --enable-magic; vcpkg also packages YARA.",
    "The README marks YARA as in maintenance mode; the YARA-X README says YARA still receives bug fixes and minor features, while new modules and large features go only into YARA-X. The command-line documentation warns that compiled rules from untrusted sources can lead to the execution of malicious code; since YARA 3.9 they load only with -C.",
    "BSD-3-Clause per COPYING."
  ],
  "requirements_zh": [
    "支持 Windows、Linux 和 macOS；审阅时的版本为 v4.6.0，于 2026-10-27 发布。从源码构建需要 automake、libtool、make、gcc 和 pkg-config。依赖 OpenSSL 的功能只在系统已安装 OpenSSL 时启用；cuckoo（依赖 Jansson）和 magic（依赖 libmagic）模块须分别以 --enable-cuckoo 或 --enable-magic 编译才会包含。也可通过 vcpkg 安装 YARA。",
    "README 标明 YARA 已进入维护模式；YARA-X 的 README 称 YARA 仍会获得缺陷修复和小功能更新，但新模块和大型功能只会加入 YARA-X。命令行文档警告，来自不可信来源的已编译规则可能导致恶意代码被执行；自 YARA 3.9 起，加载已编译规则必须显式加上 -C 参数。",
    "依 COPYING 采用 BSD-3-Clause 许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/VirusTotal/yara",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}