Skip to content
yararules.org
Menu

Glossary

Module

YARA modules add parsed file formats and helper functions to conditions, for example pe, elf, dotnet, math and hash.

A module is imported with import "pe" and exposes fields and functions in the condition: pe.imports("kernel32.dll", "VirtualAllocEx"), elf.type, math.entropy(0, 4096), hash.sha256(0, filesize). Modules only parse files they recognise.

The browser build used here supports pe, elf, macho, dotnet, lnk, math, hash, time, console, string, dex, crx, cuckoo and vt. See the modules guide.