Reverse Engineering and Malware Analysis
Reverse Engineering and Malware Analysis
Sign in to save your progress, earn points, and unlock module exams.
Topic 2.4 of Fundamentals of Malware Analysis
Shannon entropy as a packing and encryption detector — entropy ranges, per-section interpretation, the VirtualSize vs SizeOfRawData trick, and reading entropy output from PEStudio and DIE.
By the end of this topic, you will
Quadrant 1 · e-Tutorial
EZ Bytes · quick recaps
Entropy Analysis: Spotting Packed Malware
41s
Video lessons
Quadrant 2 · e-Content
Quadrant 3 · Web Resources
Downloadable reference material
External links
PEStudio — PE Static Analysis Tool
Free PE analysis tool that displays per-section entropy, imports, strings, and indicators. Install in your analysis VM.
Detect-It-Easy (DIE) — Packer and Compiler Identifier
Free tool that identifies packers, compilers, and protectors by signature matching. Displays entropy graphs per section.
Quadrant 4 · Self-Assessment
Fundamentals of Malware Analysis
Covers the analysis environment, PE file structure, static property examination, behavioural analysis, and dynamic code analysis of Windows executables.
REMA: Complete Assessment
A comprehensive 120-question assessment covering the entire Reverse Engineering and Malware Analysis curriculum: malware taxonomy and reverse engineering fundamentals, static and dynamic analysis, reversing malicious code, malicious web and document files, in-depth analysis of packed and fileless malware, and self-defending malware techniques.
Quadrant 5 · Play
Ungraded practice for Entropy Analysis: games and hands-on Skill Labs that use this topic, plus the crossword for Fundamentals of Malware Analysis. It never affects your unit assessment, and clearing a game or lab for the first time earns EZ Board points when you are signed in.
Lab
PE Autopsy: Triage a Real Signed Windows Binary
15 tasks from this unit. Free to play. Earn 30 EZ Board points on your first clear.
Lab
Packed and Unpacked: Defeat a Packer
13 tasks from this unit. Free to play. Earn 30 EZ Board points on your first clear.
Crossword
Fundamentals of Malware Analysis
11 key terms from this unit. Free to play.
Race
PE Pass
6 checkpoints from this unit. Free to play. Earn 30 EZ Board points on your first clear.
Discussion · 0 comments
This is the discussion thread for the lesson "Entropy Analysis" (Reverse Engineering and Malware Analysis, Unit 2). Ask questions, share real-world examples, and help classmates who are stuck. Conversation starters. Try explaining one of these in your own words: - Define Shannon entropy and describe its 0-to-8 scale - State the entropy threshold above which a .text section is almost certainly packed - Explain why high entropy in .rsrc is less suspicious than high entropy in .text
No comments yet. Start the conversation. Comments here also appear in the forum.
Open in forumREMA eBook 2026 — Chapter 2, Entropy Analysis
Read the full entropy comparison figures and packing indicators table in the REMA eBook.