YARA reminds me of the venerable "file" utility, and I wonder if YARA could be used in place of it to identify non-malware files that "file" has trouble identifying.