PE / ELF Section Entropy & Malware Packer Signature Inspector (2026)

Shannon entropy measures the randomness of byte values (0x00–0xFF) on a logarithmic scale from 0.0 to 8.0 bits per byte. Native compiled x86/x64 machine code contains repetitive instruction opcodes and padding, yielding an entropy between 5.0 and 6.4. Compression (like UPX/LZMA) or encryption (AES/RC4 crypters) strips redundancy, pushing section entropy above 7.2–7.99 bits/byte.

When UPX packs an executable, it compresses the original code and data into UPX1 and sets UPX0 to have a large VirtualSize (matching the uncompressed image size) but a SizeOfRawData of 0 on disk. At runtime, the tiny decompression stub in UPX1 unpacks the original binary into the pre-allocated UPX0 memory region and jumps to the Original Entry Point (OEP).

Modern compilers enforce W^X (Write XOR Execute) memory protection: code sections (.text) are Read+Execute (RX), and data sections (.data) are Read+Write (RW). A section requesting RWX permissions in its PE header almost always indicates self-modifying code or a runtime unpacking stub.

A compressor like UPX simply shrinks the binary using UCL/NRV/LZMA and restores the original native x86 instructions in memory at runtime. A virtualizing protector like VMProtect or Themida translates native x86/x64 instructions into proprietary randomized bytecode executed by an embedded virtual machine interpreter, defeating simple memory-dump unpacking.

Never. The file is read locally via the browser's FileReader ArrayBuffer API, and all PE/ELF header parsing and Shannon entropy math run entirely on your CPU.