Skip to content

Glossary

Entropy (Shannon entropy)

A measure, in bits per byte from 0 to 8, of how random data looks; values close to 8 indicate compressed or encrypted content.

Shannon entropy is computed from the frequency of each byte value. Repetitive data scores near 0; compressed or encrypted data scores close to 8 bits per byte. Compiled code typically sits around 5 to 6.8.

Applied to each section of a PE file, it is a quick packing test: a code section above about 7.2 is probably compressed or encrypted and will be unpacked at run time. Images, archives and certificates are high-entropy by nature, so context matters. See detecting packed executables.