Write, compile, and test YARA-X rules locally in your browser. Inspect rule matches and byte offsets, control scan timeouts, and save findings as evidence.
The workbench embeds the official YARA-X WebAssembly engine. Compile rules before scanning, review compiler diagnostics and warnings, then scan the active Binary Lab artifact without uploading it.
Matched rules include namespace, tags, metadata, string identifiers, match kinds, exact offsets, and lengths. A bounded timeout and per-pattern match limit keep browser scans controlled.
YARA matches are detection evidence, not a malware verdict. Validate rule intent and false-positive conditions before operational use.
It uses the official YARA-X JavaScript bindings and a pinned local WebAssembly engine. Rule compilation and file scanning occur in the browser.
No. Matches depend on rule quality and context. Treat them as detection evidence and review false-positive conditions before taking action.
Artifacts are limited to 32 MiB, rule source to 512 KiB, timeout choices to at most 30 seconds, and reported matches per pattern to a fixed maximum.
Keep binary artifacts, hashes, notes, findings, derived files, and analysis-tool handoffs together in a private browser workspace.
Extract ASCII and Unicode strings from binary files for malware analysis. Detect URLs, IPs, file paths, registry keys, and email addresses.
Free Shannon entropy calculator for malware analysis. Detect packed, encrypted, or obfuscated binaries with entropy visualization, byte distribution analysis, and section-by-section scanning.
Inspect PE, ELF, Mach-O, universal binaries, and Unix archives with bounded parsers, sections, imports, exports, mitigations, signatures, and suspicious regions.