Entropy (Shannon)
Definition
Per-byte information density of a file or section. Plain code sits around 5.5; packed or encrypted sections exceed 7.0. A PE with a high-entropy section that is not a known packer signature is almost always packed; the entropy line is the first static signal of obfuscation.
- Typical plain code
- Around 5.5 bits per byte
- Packed/encrypted threshold
- Above roughly 7.0 bits per byte
- Use
- First static signal of packing or obfuscation
Common questions
Does a high-entropy section always mean the file is malicious?+
No. Legitimate commercial software also uses packers and encrypted resources for anti-tampering or licensing, so high entropy flags a section for further static and dynamic analysis rather than confirming malicious intent by itself.
Why check entropy before running the sample dynamically?+
Entropy scanning is fast and safe to run on a static file before execution, letting an analyst decide whether an unpacking step is needed first, so the dynamic sandbox observes the real unpacked behaviour rather than just the packer stub.
Related terms
- ImpHash
- Mandiant's hash of the ordered list of imported functions in a PE file's import table. Survives recompilation that does not change imports;...
- IoC (Indicator of Compromise)
- Observable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipes,...
- PE (Portable Executable) Header
- The Windows executable file format. Starts with an MZ DOS stub, points to a PE signature, then a COFF file header, an...
- Volatility 3
- Open-source memory forensics framework, Python 3 rewrite of Volatility 2. Symbol-based (PDB symbols on Windows) instead of profile-based, supports modern Windows 10/11...
- YARA
- Pattern-matching language for malware classification. Rules combine string and byte-pattern conditions with metadata. Used by VirusTotal, every major sandbox, and most threat-intel...