Malware and entropy

MrBrian · Mar 2, 2011

From Mal(ware)formation statistics:

When it comes to the use of packers in malware here are some stats on the new unique sample submissions we received during the last month (samples seen in previous months were discarded for the study). Using PEid with a customized database of packing signatures (available here), a purpose built emulator and some generic unpacking routines, we found that 79% of new malware is using some type of packing technique or other.
Click to expand...

From Malware Validation Techniques:

The percentage of malware that is packed is significant, with some estimates reflecting that 70-80 % of malware is packed. Meanwhile, some non-malware is also packed, but the percentage is much smaller, perhaps less than 5%. Therefore, if a suspicious file is packed, it is highly likely to be malware.
Click to expand...

From paper "Using Entropy Analysis to Find Encrypted and Packed Malware" (hxxp://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.120.9861&rep=rep1&type=pdf):

The advantage of using entropy analysis is that it offers a convenient and quick technique for analyzing a sample at the binary level and identifying suspicious PE ﬁle regions.
Click to expand...

Free programs that I tried that calculate entropy:
1. Process Explorer - highlights in purple (if default settings are used) processes (and also DLLs if viewing in lower pane) whose corresponding disk file is likely packed. No entropy calculation is explicitly given.
2. Entyzer - command-line program that calculates either entropy of whole file, or of individual sections, depending on the argument supplied. I had no problems with the 32 bit version, but had problems with the 64 bit version.
3. Malware Analyzer v2.8 - command-line program that calculates entropy of individual sections; can't remember if entropy of whole file is also given.
4. PeSweep - command-line program that calculates entropy of individual sections; can't remember if entropy of whole file is also given.
5. Ent (hxxp://gynvael.coldwind.pl/?id=162 and hxxp://gynvael.coldwind.pl/?id=158 ) - calculates entropy of whole file, and also gives detailed graph of file regions with high entropy; graph can get very long.
6. Bytehist - Graphically shows byte distribution by whole file and also by section, which is useful although it isn't the same as entropy.
7. CrypTool - calculates entropy and also floating frequency; calculates these slowly.
8. PEiD - it's unclear what part of file the entropy calculations are performed on
9. Mandiant Red Curtain - calculates entropy of whole file and also code section; can calculate entropy of all files in a given folder.

Free programs that I didn't try that calculate entropy:
1. El Jefe.
2. PEPackerInfo2.0.py - used in paper "Classification of Packed Executables for Accurate Computer Virus Detection."
3. Hexer entropy plugin
4. IDA Entropy Plugin
5. Crypto Implementations Analysis Toolkit
6. Ent - hxxp://www.fourmilab.ch/random/

Of those that I tried, I recommend Process Explorer, Entyzer, Ent, Mandiant Red Curtain, and Bytehist.

P.S. Hitman Pro uses entropy as one of the characteristics to determine if a file is suspicious.

SUPERIOR · Mar 3, 2011

thanks MrBrian for this info
i guess "Universal Virus Sniffer" and "Advanced malware identification" tools use entropy to detect suspicious processes too

MrBrian · Mar 3, 2011

SUPERIOR said:

thanks MrBrian for this info
i guess "Universal Virus Sniffer" and "Advanced malware identification" tools use entropy to detect suspicious processes too
Click to expand...

Thank you for the info also, and you're welcome .

Log in or Sign up

Malware and entropy

MrBrian Registered Member

SUPERIOR Registered Member

MrBrian Registered Member

Log in or Sign up

Malware and entropy

MrBrian Registered Member

SUPERIOR Registered Member

MrBrian Registered Member

Useful Searches