Categories: Cyber Security News

YARA-X 1.11.0 Released With a New Hash Function Warnings

VirusTotal has released YARA-X version 1.11.0, introducing an important new feature designed to improve rule reliability and reduce false negatives in malware detection.

The latest update introduces hash-function warnings that help security researchers catch common mistakes when writing YARA detection rules.

YARA-X is a malware detection engine widely used by cybersecurity professionals to identify malicious files.

When writing YARA rules, analysts often need to match specific cryptographic hashes, either the complete file hash or portions of file content.

However, these operations are fundamentally string comparisons rather than direct hash validations.

The hash functions in YARA-X, such as hash. sha256, return hexadecimal strings representing the calculated hash value.

These strings are then compared against literal hash values specified in the rule. This process works correctly, but introduces opportunities for human error.

The new warning system addresses two prevalent issues that plague YARA rule development:

Typos and formatting errors: Security analysts frequently make simple mistakes when entering hash values.

Adding an unintentional space, mistyping characters, or introducing formatting inconsistencies prevents the rule from matching intended targets. Previously, these errors would silently fail without notification.

Hash algorithm mismatches: Another common problem occurs when developers accidentally mix hash types.

For example, providing a SHA1 hash string when a SHA256 comparison is intended. The rule would never match because the string lengths and formats don’t align properly.

Additional Release Improvements

Beyond the hash function warnings, YARA-X 1.11.0 includes several significant enhancements across multiple modules and APIs.

Feature	Description
Hash Function Warnings	Flags hash errors and mismatches in YARA rules
DEX & Mach-O Updates	Improved Android and macOS file detection
CRX Permhash	Adds Chrome extension analysis support
Python & C API Updates	New imports method and console logging
Stricter Validation	Catches more rule errors
GIL Optimization & Fixes	Improves stability and scan performance

The DEX module implementation enables detection capabilities for Android DEX files. In contrast, the macOS module now supports parsing additional Mach-O load commands, including LC_LAZY_LOAD_DYLIB and LC_LOAD_UPWARD_DYLIB.

The release also strengthens the parser to enforce stricter validation rules. It introduces new functionality, such as the imports() method for the Python API.

The permhash feature has been implemented for the CRX module, expanding Chrome extension analysis capabilities. The update resolves critical bugs affecting parser reliability and rule execution.

Fixed issues include panic conditions when comparing booleans and handling invalid Unicode escape sequences.

The Python module has been optimized to prevent unnecessary Global Interpreter Lock acquisition during scan operations, improving performance.

According to GitHub advisory, YARA-X 1.11.0 is available on Windows, macOS, and Linux. The release includes both binary distributions and source code, making it accessible for developers and security teams worldwide.

This update reinforces YARA-X’s commitment to delivering robust, user-friendly malware detection capabilities.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post YARA-X 1.11.0 Released With a New Hash Function Warnings appeared first on Cyber Security News.

YARA-X 1.11.0 Released with New Hash Function Warnings

VirusTotal has released YARA-X 1.11.0, delivering a series of engine-level improvements to make rule writing safer, more predictable, and easier to debug for malware analysts and detection engineers. The highlight of this release is a new class of hash function comparison warnings designed to catch logic errors in rules before…

January 12, 2026

In "Cyber Security News"

Writing and Testing Detection Rules with Sigma and YARA

Effective threat detection requires robust tools and methodologies that can identify malicious activity across different environments. Sigma and YARA rules have emerged as powerful open-source frameworks for security analysts, allowing standardized detection methods that can be shared across platforms and teams. While Sigma rules focus on identifying suspicious patterns in…

April 17, 2025

In "Cyber Security News"

YAMAGoya – Real-Time Threat Monitoring Tool Using Sigma and YARA Rules

Modern cybersecurity faces an escalating challenge: fileless malware and obfuscation techniques increasingly bypass traditional file-based detection methods. To address this growing threat, JPCERT/CC has released YAMAGoya. This open-source threat hunting tool leverages industry-standard detection rules to identify suspicious activity in real time. YAMAGoya represents a significant advancement in endpoint threat…

November 26, 2025

In "Cyber Security News"

rssfeeds-admin