2.9.26
Released 2 Nov 2026
Official PureDecimal website
YARA rules made easy
PureDecimal 2.9.26 runs your YARA rule scanner and checks exit codes. Download the agent now to see real diffs and results.
Create a YARA rule file that matches a specific string in my test folder.
- write_file
test-rule.yarcreated - edit_file
test-rule.yaredited - write_file
test.txtcreated - Shell
yara test-rule.yar test.txt1 match - Shell
yara test-rule.yar test.txtexit 0 - read_file
test-rule.yarviewed
waiting for your OK before the next stepRejectAccept
Windows 10/11
x64 architecture only
34 MB
Setup program download
13
Interface languages
Runs locally, no telemetry; chats, working folders and API keys stay on the PC. Prompts go only to the model endpoint the user picks; with a local model nothing leaves the machine.
No telemetry data
Auto
Check for updates
YARA rules for YARA detection
PureDecimal helps you write yara rules that actually work, and the agent runs your scanner to show the results in your lab while you stay in control of your work. Version 2.9.26. The interface supports 13 languages for your convenience and ease of use. No account is needed to run the software on your computer.
Craft a YARA signature
The agent uses write_file to create the rule file and edit_file to add strings and conditions, which allows you to see the diff in Ask first mode before accepting the change. It saves the rule. You can review every line of the yara rules examples. PureDecimal is an autonomous AI agent for Windows 10/11 (x64), current version 2.9.26 (released 2 Nov 2026). No account is needed to run the software today on your local machine. The tool runs locally on your machine without issues for yara security tasks.
Tool trace
write_file rule.yar → created
edit_file rule.yar → edited
read_file rule.yar → viewedYARA rules examples for testing
A header check such as uint16(0) == 0x5A4D tests for the MZ start of a Windows executable, and write_file saves the rule to the working folder. Use Cron. Shell runs the scanner command against the test directory and returns the exit code. read_file retrieves the output log so you can verify the matches immediately. Cron schedules the rule update task to run automatically at a specific time. The gains of detection as code are clear when you automate your workflow with 256 rules.
Tool trace
edit_file detection-rule.yar → edited
read_file detection-rule.yar → read
Shell yara detection-rule.yar test.txt → 1 matchScan your files
You ask the agent to scan a folder, and it uses Shell to run the command while saving the output to a text file for later review. Matches are leads. The agent uses read_file to open that output file and display the results clearly. grep searches the content for specific YARA malware matches within the saved log data. edit_file updates your notes with the findings so you can track changes over time. This workflow supports your 13-language interface for global defenders who need clear guidance.
Review the diff
When you switch to Ask first mode, the editor shows the diff of the edit so that you can review the changes before they are applied to the rule file. Review carefully. Use edit_file to modify the detection rule file content carefully. The shell command runs the YARA scanner on your data. Cron schedules the periodic scan tasks for your analysis work. This keeps your workflow precise and clear for every step using version 2.9.26.
How it differs from a typical chat assistant
PureDecimal 2.9.26 runs commands and shows real results, so you see the diff before you accept in Ask first mode for your detection engineering road map. Trust bots.
| Typical chat assistant | PureDecimal | |
|---|---|---|
| Action | Suggests actions | Runs actions |
| Result | Shows text | Shows output |
| Edit | Rewrites text | Shows the diff |
| Control | Ask first (Ask first mode), or Auto-run | Asks first (in Ask first mode) |
How to get started
- Download the setup program on Windows 10 or 11.
- Run the installer to install PureDecimal.
- Open the app and select your model.
- Start writing your YARA detection rules today.
Who uses PureDecimal
Malware analysts use PureDecimal to write detection patterns and run their own scanners to check results carefully while handling new malware tactics detection tips for version 2.9.26. Write rules. No account needed to run the agent locally on your PC.
Defenders use PureDecimal to test rules because it runs tools and shows results in chat cards, so they review diffs and keep control of their lab while counting matches per rule. It lists matches. PureDecimal is for Windows and keeps control of their lab while counting matches per rule.
Researchers use PureDecimal to analyze strings and write yara rules because they read exported data from their isolated lab environments to classify files for detection. Ask first. Every change is shown as a diff before you accept it.
Frequently asked questions
What are YARA rules?
YARA is a pattern-matching tool that identifies malware by matching specific strings in files, and PureDecimal helps you write them with meta, strings and condition sections. Start writing. It runs the tools itself and shows results clearly for every action.
Is purcode.net the official PureDecimal website?
Yes, purcode.net is the official PureDecimal website, and you verify the installer from the download button by comparing its SHA-256 checksum with the published manifest. Check the hash. The setup program is about 34 MB for Windows 10 and 11 systems.
Does PureDecimal run locally?
Yes, the app runs locally on your PC, but prompts go to the model endpoint you pick, and only with a local model nothing leaves the PC. Stay private. No account is needed to run the software on your Windows 10 or 11 computer.
What is YARA security?
Yes, YARA is a pattern-matching tool that classifies files by reading their content without executing them, and samples belong in an isolated lab virtual machine you set up. Rules work well. PureDecimal helps you write these rules using the chat interface and tools.
How does PureDecimal support your YARA detection workflow?
PureDecimal is a local agent that runs your YARA scanner and saves the output so you can count matches and review results before writing better rules for your own analysis. It counts matches. You stay in control of your entire analysis workflow today.
What does YARA do for security?
A detection pattern is a heuristic that can miss future variants because attackers change files, so it may also match clean files and produce false positives. No, it is not. PureDecimal edits rule files and shows every change as a diff.
What do people mean by yara malware in detection rules?
YARA is a pattern-matching tool that classifies files by reading them without executing, and PureDecimal assists you in writing rules while your samples stay in your isolated lab VM. It is a heuristic. Rules are written from exported text and rule files that you review.
Start writing YARA rules
PureDecimal version 2.9.26 runs your scanner and shows results in the chat, so you can download the 34 MB installer now. Go.
Download PureDecimal for Windows ↗Explore the site
Every page of this website is available in 20 languages. The app interface itself has 13.
Product features ↗ Model configuration ↗ Workflow examples ↗ Download installer ↗ FAQ details ↗ Privacy policy ↗
