vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
reverse-skills-max/vendor-new/analyst-ai-pack/skills/measuring-section-entropy-to-detect-packing/SKILL.md

3.2 KiB
Raw Permalink Blame History

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references
name description domain subdomain tags version author license mitre_attack d3fend references
measuring-section-entropy-to-detect-packing Detects packing and encryption by measuring Shannon entropy across a binary's sections and regions: flagging high-entropy executable sections, entropy spikes, and size/raw-vs-virtual anomalies that indicate compression or encryption. Activates for requests to measure entropy, detect packing, or assess whether a sample is compressed/encrypted. cybersecurity malware-analysis
malware-analysis
entropy
packing
static-analysis
pe
1.0.0 analyst-ai-pack Apache-2.0
T1027.002
T1027
D3-FCR
Shannon, A Mathematical Theory of Communication (entropy) — https://doi.org/10.1002/j.1538-7305.1948.tb01338.x
Microsoft PE/COFF specification — https://learn.microsoft.com/windows/win32/debug/pe-format

Measuring Section Entropy to Detect Packing

When to Use

  • You want a quick statistical signal of whether a sample is packed or encrypted.
  • You are triaging a PE and need to flag suspicious high-entropy executable sections.
  • You are deciding whether to route a sample to an unpacking workflow.

Do not use entropy as a verdict — legitimate compressed resources and installers also show high entropy; combine with imports, section names, and raw/virtual size anomalies.

Prerequisites

  • Python (math stdlib); optionally pefile for per-section analysis.

Safety & Handling

  • Compute entropy on the inert file; never execute the sample.
  • Keep the sample password-protected at rest and reference it by hash.

Workflow

Step 1: Compute whole-file and sliding-window entropy

Calculate Shannon entropy (0–8 bits/byte). Sliding-window entropy reveals localized high-entropy regions even when the overall value is moderate.

python scripts/analyst.py entropy sample.exe

Step 2: Compute per-section entropy (PE)

For each PE section, compute entropy and compare raw vs. virtual size. Executable sections with entropy > ~7.0 are a packing indicator.

Step 3: Correlate structural anomalies

Flag classic packer signs: high-entropy .text, unusual/renamed sections (UPX0, random names), tiny raw size but large virtual size, and an entry point outside .text.

Step 4: Decide routing

If indicators stack (high entropy + thin IAT + odd sections), route to unpacking; otherwise proceed with normal static analysis.

Validation

  • High-entropy executable sections are corroborated by other packing signs before concluding.
  • Benign high-entropy cases (compressed resources) are not misclassified as packers.
  • The routing decision (unpack vs. proceed) is justified by combined indicators.

Pitfalls

  • Calling any high-entropy file "packed" without structural corroboration.
  • Ignoring sliding-window entropy and missing a localized encrypted blob.
  • Overlooking raw-vs-virtual size mismatch, a strong unpacking-at-runtime hint.

References