Yara magic numbers for all currently available versions
@ Rakovsky Stanislav | Thursday, Jan 21, 2021 | 6 minutes read | Update at Thursday, Jan 21, 2021

You are here probably because you was googling for yara file magic. You know, you cannot use another version of yara engine on compiled yara file - you will got errors like:

  • rules were compiled with a newer version of YARA.
  • rules were compiled with a different version of YARA

So, here is the list of all major versions of YARA available. If you know about any version that is missing - let me know!

YARA v4.0.2
File:			yara-v4.0.2-1347-win32.zip
Created:		2020-06-26T07:33:16Z
Link:			https://github.com/VirusTotal/yara/releases/download/v4.0.2/yara-v4.0.2-1347-win32.zip
Magic space:		59:41:52:41:11:0c:96:00:00:00:00:00:00:00:0c:00
Magic colon:		59 41 52 41 11 0c 96 00 00 00 00 00 00 00 0c 00
Magic w/o sep:		59415241110c96000000000000000c00
Magic raw:		b'YARA\x11\x0c\x96\x00\x00\x00\x00\x00\x00\x00\x0c\x00'
As B64:			WUFSQREMlgAAAAAAAAAMAA==
Version magic is the first byte after the header
--------------------------------------------------------------------------------
YARA v4.0.1
File:			yara-v4.0.1-1323-win32.zip
Created:		2020-05-15T08:58:54Z
Link:			https://github.com/VirusTotal/yara/releases/download/v4.0.1/yara-v4.0.1-1323-win32.zip
Magic space:		59:41:52:41:11:0c:96:00:00:00:00:00:00:00:0c:00
Magic colon:		59 41 52 41 11 0c 96 00 00 00 00 00 00 00 0c 00
Magic w/o sep:		59415241110c96000000000000000c00
Magic raw:		b'YARA\x11\x0c\x96\x00\x00\x00\x00\x00\x00\x00\x0c\x00'
As B64:			WUFSQREMlgAAAAAAAAAMAA==
Version magic is the first byte after the header
--------------------------------------------------------------------------------
YARA v4.0.0
File:			yara-v4.0.0-1305-win32.zip
Created:		2020-04-28T11:00:48Z
Link:			https://github.com/VirusTotal/yara/releases/download/v4.0.0/yara-v4.0.0-1305-win32.zip
Magic space:		59:41:52:41:11:0c:96:00:00:00:00:00:00:00:0c:00
Magic colon:		59 41 52 41 11 0c 96 00 00 00 00 00 00 00 0c 00
Magic w/o sep:		59415241110c96000000000000000c00
Magic raw:		b'YARA\x11\x0c\x96\x00\x00\x00\x00\x00\x00\x00\x0c\x00'
As B64:			WUFSQREMlgAAAAAAAAAMAA==
Version magic is the first byte after the header
--------------------------------------------------------------------------------
YARA v3.11.0
File:			yara-v3.11.0-994-win32.zip
Created:		2019-10-10T11:11:56Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.11.0/yara-v3.11.0-994-win32.zip
Magic space:		59:41:52:41:a0:34:00:00:20:00:16:00:60:00:00:00
Magic colon:		59 41 52 41 a0 34 00 00 20 00 16 00 60 00 00 00
Magic w/o sep:		59415241a03400002000160060000000
Magic raw:		b'YARA\xa04\x00\x00 \x00\x16\x00`\x00\x00\x00'
As B64:			WUFSQaA0AAAgABYAYAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.10.0
File:			yara-v3.10.0-904-win32.zip
Created:		2019-05-02T10:24:30Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.10.0/yara-v3.10.0-904-win32.zip
Magic space:		59:41:52:41:a0:34:00:00:20:00:16:00:60:00:00:00
Magic colon:		59 41 52 41 a0 34 00 00 20 00 16 00 60 00 00 00
Magic w/o sep:		59415241a03400002000160060000000
Magic raw:		b'YARA\xa04\x00\x00 \x00\x16\x00`\x00\x00\x00'
As B64:			WUFSQaA0AAAgABYAYAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.9.0
File:			yara-v3.9.0-win32.zip
Created:		2019-02-22T16:37:14Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.9.0/yara-v3.9.0-win32.zip
Magic space:		59:41:52:41:a0:34:00:00:20:00:15:00:60:00:00:00
Magic colon:		59 41 52 41 a0 34 00 00 20 00 15 00 60 00 00 00
Magic w/o sep:		59415241a03400002000150060000000
Magic raw:		b'YARA\xa04\x00\x00 \x00\x15\x00`\x00\x00\x00'
As B64:			WUFSQaA0AAAgABUAYAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.8.1
File:			yara-v3.8.1-win32.zip
Created:		2018-08-16T13:23:56Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.8.1/yara-v3.8.1-win32.zip
Magic space:		59:41:52:41:90:32:00:00:20:00:13:00:60:00:00:00
Magic colon:		59 41 52 41 90 32 00 00 20 00 13 00 60 00 00 00
Magic w/o sep:		59415241903200002000130060000000
Magic raw:		b'YARA\x902\x00\x00 \x00\x13\x00`\x00\x00\x00'
As B64:			WUFSQZAyAAAgABMAYAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.8.0
File:			yara-v3.8.0-win32.zip
Created:		2018-08-06T13:51:27Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.8.0/yara-v3.8.0-win32.zip
Magic space:		59:41:52:41:90:32:00:00:20:00:13:00:60:00:00:00
Magic colon:		59 41 52 41 90 32 00 00 20 00 13 00 60 00 00 00
Magic w/o sep:		59415241903200002000130060000000
Magic raw:		b'YARA\x902\x00\x00 \x00\x13\x00`\x00\x00\x00'
As B64:			WUFSQZAyAAAgABMAYAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.7.1
File:			yara-v3.7.1-win32.zip
Created:		2018-01-16T10:31:42Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.7.1/yara-v3.7.1-win32.zip
Magic space:		59:41:52:41:90:42:00:00:20:00:10:00:60:00:00:00
Magic colon:		59 41 52 41 90 42 00 00 20 00 10 00 60 00 00 00
Magic w/o sep:		59415241904200002000100060000000
Magic raw:		b'YARA\x90B\x00\x00 \x00\x10\x00`\x00\x00\x00'
As B64:			WUFSQZBCAAAgABAAYAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.7.0
File:			yara-v3.7.0-win32.zip
Created:		2017-11-10T12:31:06Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.7.0/yara-v3.7.0-win32.zip
Magic space:		59:41:52:41:90:42:00:00:20:00:10:00:60:00:00:00
Magic colon:		59 41 52 41 90 42 00 00 20 00 10 00 60 00 00 00
Magic w/o sep:		59415241904200002000100060000000
Magic raw:		b'YARA\x90B\x00\x00 \x00\x10\x00`\x00\x00\x00'
As B64:			WUFSQZBCAAAgABAAYAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.6.3
File:			yara-v3.6.3-win32.zip
Created:		2017-07-05T14:36:33Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.6.3/yara-v3.6.3-win32.zip
Magic space:		59:41:52:41:70:42:00:00:20:00:0d:00:50:00:00:00
Magic colon:		59 41 52 41 70 42 00 00 20 00 0d 00 50 00 00 00
Magic w/o sep:		594152417042000020000d0050000000
Magic raw:		b'YARApB\x00\x00 \x00\r\x00P\x00\x00\x00'
As B64:			WUFSQXBCAAAgAA0AUAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.6.2
File:			yara-v3.6.2-win32.zip
Created:		2017-06-28T20:48:11Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.6.2/yara-v3.6.2-win32.zip
Magic space:		59:41:52:41:70:42:00:00:20:00:0d:00:50:00:00:00
Magic colon:		59 41 52 41 70 42 00 00 20 00 0d 00 50 00 00 00
Magic w/o sep:		594152417042000020000d0050000000
Magic raw:		b'YARApB\x00\x00 \x00\r\x00P\x00\x00\x00'
As B64:			WUFSQXBCAAAgAA0AUAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.6.1
File:			yara-v3.6.1-win32.zip
Created:		2017-06-05T17:38:03Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.6.1/yara-v3.6.1-win32.zip
Magic space:		59:41:52:41:70:42:00:00:20:00:0d:00:50:00:00:00
Magic colon:		59 41 52 41 70 42 00 00 20 00 0d 00 50 00 00 00
Magic w/o sep:		594152417042000020000d0050000000
Magic raw:		b'YARApB\x00\x00 \x00\r\x00P\x00\x00\x00'
As B64:			WUFSQXBCAAAgAA0AUAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.6.0
File:			yara-v3.6.0-win32.zip
Created:		2017-05-22T11:57:40Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.6.0/yara-v3.6.0-win32.zip
Magic space:		59:41:52:41:70:42:00:00:20:00:0d:00:50:00:00:00
Magic colon:		59 41 52 41 70 42 00 00 20 00 0d 00 50 00 00 00
Magic w/o sep:		594152417042000020000d0050000000
Magic raw:		b'YARApB\x00\x00 \x00\r\x00P\x00\x00\x00'
As B64:			WUFSQXBCAAAgAA0AUAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.5.0
File:			yara-v3.5.0-win32.zip
Created:		2016-09-06T20:10:34Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.5.0/yara-v3.5.0-win32.zip
Magic space:		59:41:52:41:70:42:00:00:0b:00:00:00:00:00:00:00
Magic colon:		59 41 52 41 70 42 00 00 0b 00 00 00 00 00 00 00
Magic w/o sep:		59415241704200000b00000000000000
Magic raw:		b'YARApB\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00'
As B64:			WUFSQXBCAAALAAAAAAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.4.0
File:			yara-v3.4.0-win32.zip
Created:		2015-06-18T13:57:55Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.4.0/yara-v3.4.0-win32.zip
Magic space:		59:41:52:41:5b:0a:00:00:08:00:00:00:00:59:08:00
Magic colon:		59 41 52 41 5b 0a 00 00 08 00 00 00 00 59 08 00
Magic w/o sep:		594152415b0a00000800000000590800
Magic raw:		b'YARA[\n\x00\x00\x08\x00\x00\x00\x00Y\x08\x00'
As B64:			WUFSQVsKAAAIAAAAAFkIAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.3.0
File:			yara-v3.3.0-win32.zip
Created:		2015-02-10T12:45:17Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.3.0/yara-v3.3.0-win32.zip
Magic space:		59:41:52:41:52:0a:00:00:06:00:00:00:00:50:08:00
Magic colon:		59 41 52 41 52 0a 00 00 06 00 00 00 00 50 08 00
Magic w/o sep:		59415241520a00000600000000500800
Magic raw:		b'YARAR\n\x00\x00\x06\x00\x00\x00\x00P\x08\x00'
As B64:			WUFSQVIKAAAGAAAAAFAIAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.2.0
File:			yara-v3.2.0-win32.zip
Created:		2014-11-10T15:23:07Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.2.0/yara-v3.2.0-win32.zip
Magic space:		59:41:52:41:5a:0a:00:00:04:00:00:00:00:50:08:00
Magic colon:		59 41 52 41 5a 0a 00 00 04 00 00 00 00 50 08 00
Magic w/o sep:		594152415a0a00000400000000500800
Magic raw:		b'YARAZ\n\x00\x00\x04\x00\x00\x00\x00P\x08\x00'
As B64:			WUFSQVoKAAAEAAAAAFAIAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v2.0.0
File:			yara-v2.0.0-win32.zip
Created:		2013-12-26T14:01:02Z
Link:			https://github.com/VirusTotal/yara/releases/download/v2.0.0/yara-v2.0.0-win32.zip
Magic space:		59:41:52:41:00:38:00:00:01:1c:08:00:00:00:00:00
Magic colon:		59 41 52 41 00 38 00 00 01 1c 08 00 00 00 00 00
Magic w/o sep:		5941524100380000011c080000000000
Magic raw:		b'YARA\x008\x00\x00\x01\x1c\x08\x00\x00\x00\x00\x00'
As B64:			WUFSQQA4AAABHAgAAAAAAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.1.0
File:			yara-v3.1.0-win32.zip
Created:		2014-08-26T11:06:52Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.1.0/yara-v3.1.0-win32.zip
Magic space:		59:41:52:41:5a:0a:00:00:03:00:00:00:00:50:08:00
Magic colon:		59 41 52 41 5a 0a 00 00 03 00 00 00 00 50 08 00
Magic w/o sep:		594152415a0a00000300000000500800
Magic raw:		b'YARAZ\n\x00\x00\x03\x00\x00\x00\x00P\x08\x00'
As B64:			WUFSQVoKAAADAAAAAFAIAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v3.0.0
File:			yara-v3.0.0-win32.zip
Created:		2014-08-13T13:23:50Z
Link:			https://github.com/VirusTotal/yara/releases/download/v3.0.0/yara-v3.0.0-win32.zip
Magic space:		59:41:52:41:5a:0a:00:00:03:00:00:00:00:50:08:00
Magic colon:		59 41 52 41 5a 0a 00 00 03 00 00 00 00 50 08 00
Magic w/o sep:		594152415a0a00000300000000500800
Magic raw:		b'YARAZ\n\x00\x00\x03\x00\x00\x00\x00P\x08\x00'
As B64:			WUFSQVoKAAADAAAAAFAIAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------
YARA v2.1.0
File:			yara-v2.1.0-win32.zip
Created:		2014-03-05T11:15:10Z
Link:			https://github.com/VirusTotal/yara/releases/download/v2.1.0/yara-v2.1.0-win32.zip
Magic space:		59:41:52:41:00:38:00:00:03:00:00:00:00:50:08:00
Magic colon:		59 41 52 41 00 38 00 00 03 00 00 00 00 50 08 00
Magic w/o sep:		59415241003800000300000000500800
Magic raw:		b'YARA\x008\x00\x00\x03\x00\x00\x00\x00P\x08\x00'
As B64:			WUFSQQA4AAADAAAAAFAIAA==
Version magic is the second DWORD after the header
--------------------------------------------------------------------------------

Rakovsky Stanislav

yara
Save as image

Cats!

Under construction

Wow! Flipable!

Hello from another side of the Moon!

Looking for a flag? Okay, take this:
LFXXKIDBOJSSA43XMVSXIIC6LYQCAIA=

About me

Under construction. You can try to contact me and fill this field… haha… ha…