I have previously posted on Infosec Institute an article about Classifying Malware with ClamAV and YARA, the article is focused on using open source tools under Linux system to create descriptions of malware families based on textual or binary patterns contained in samples from those families and to quickly identify known malware.
Two days ago Yara added a new Win32 based version under windows operating system without requiring Python runtime support.
YARA is used by VirusTotal Malware Intelligence Services (http://vt-mis.com),jsunpack-n (http://jsunpack.jeek.org/) and We Watch Your Website (http://www.wewatchyourwebsite.com/).