How to entropy analysis vs antivirus: why you need both
- Step 1Drop the suspicious file — Upload the file to the Entropy Analyzer. It computes Shannon entropy per 256-byte chunk and plots the distribution.
- Step 2Read the entropy chart — The amber reference line at 7.5 bits/byte marks the high-entropy threshold. Uniform values above this line across the whole file indicate packing or encryption.
- Step 3Correlate with AV result — If AV is clean but entropy is uniformly high, the file may be packed with an unknown or custom packer. Escalate to sandbox detonation.
Frequently asked questions
Do encrypted archives also trigger high entropy?+
Yes. An AES-encrypted ZIP looks identical to encrypted malware from an entropy perspective. Context matters: file name, source, and magic bytes help distinguish them.
What is a normal entropy profile for a Windows EXE?+
Unpacked EXEs typically show entropy of 4.5–6.5 bits/byte in code sections, dropping to 2–4 in data and string sections. Compressed resources (.rsrc) may reach 7–7.5. Uniform values above 7.5 suggest packing.
Can entropy analysis replace AV?+
No. They complement each other. AV catches known threats with high precision. Entropy analysis catches novel packed/encrypted threats that bypass signatures. Use both in your pipeline.
Privacy first
Every JAD Security operation runs entirely in your browser. Files, passwords, and PGP private keys never leave your device — verified by zero outbound network requests during processing.