YARA Rule Anatomy

reference. Ignored by matching —- pure documentation.

• Text: $a = "malware.evil.com" (modifiers: nocase, wide, ascii, fullword)
• Hex: { = { 6A 40 68 00 30 00 00 }} (wildcards ??, jumps [4-6])
• Regex: $c = /https?:\textbackslash/\textbackslash/[a-z0-9.]+/

where, plus filesize, uint16(0), pe.*, etc.