# Use YARA math Module Extension in THOR TechPreview and THOR Lite **[nextron-systems.com/2021/06/15/use-yara-math-module-extension-in-thor-techpreview-and-thor-lite/](https://www.nextron-systems.com/2021/06/15/use-yara-math-module-extension-in-thor-techpreview-and-thor-lite/)** June 15, 2021 [Not long ago, we’ve created a pull request for the official YARA repository on Github, that](https://github.com/VirusTotal/yara/pull/1483) would introduce new functions in the `math` module to improve the flexibility in cases in which a sample is heavily scrambled or obfuscated. These cases require further statistical evaluations that go beyond the currently available “entropy”, “mean” or “deviation” functions. The example on the right shows a heavily obfuscated PHP web shell, as used by a Chinese actor. You immediately notice the high amount of “%” characters, but since each of them is preceded and followed by different characters, it’s difficult to find atoms that are long enough to maintain an acceptable performance / stability of that rule. ----- If you could, you would formulate a rule like this: “Detect files smaller 400 bytes, that begin with ‘