mauricelambert/entropyanalysis

This package analyzes file entropy (shannon entropy) for forensic and malware analysis.

EntropyAnalysis

Description

This package analyzes file entropy (shannon entropy) for forensic or malware analysis

Requirements

This package require:

• python3
• python3 Standard Library

Optional:

• matplotlib (matplotlib is not installed by EntropyAnalysis, if you want GUI charts you should install it.)

Installation

python3 -m pip install EntropyAnalysis

# The following line is optional (requirements for GUI charts)
python3 -m pip install matplotlib

git clone "https://github.com/mauricelambert/EntropyAnalysis.git"
cd "EntropyAnalysis"
python3 -m pip install .

Usages

Command line

EntropyAnalysis              # Using CLI package executable
python3 -m EntropyAnalysis   # Using python module
python3 EntropyAnalysis.pyz  # Using python executable
EntropyAnalysis.exe          # Using python Windows executable

EntropyAnalysis packed.exe
EntropyAnalysis -c packed.exe
EntropyAnalysis --all-characters packed.exe
EntropyAnalysis -f -C packed.exe
EntropyAnalysis -p 1024 packed.exe
EntropyAnalysis -o -k 4096 packed.exe
EntropyAnalysis -k 4096 -p 1024 packed.exe
EntropyAnalysis -u https://github.com/mauricelambert/FastRC4/releases/download/v0.0.1/librc4.so

Python script

from EntropyAnalysis import *
from urllib.request import urlopen

get_full_file_entropy(open('packed.exe', 'rb'))

charts_chunks_file_entropy(open('packed.exe', 'rb'))
charts_chunks_file_entropy(urlopen('https://github.com/mauricelambert/FastRC4/releases/download/v0.0.1/librc4.dll'), chunk_size=2048, part_size=512)

for score in get_chunks_file_entropy(open('packed.exe', 'rb')):
    print(score)

for score in get_chunks_file_entropy(urlopen('https://github.com/mauricelambert/FastRC4/releases/download/v0.0.1/librc4.dll'), chunk_size=2048):
    print(score)

print_chunks_file_entropy(open('packed.exe', 'rb'))
print_parts_chunks_file_entropy(open('packed.exe', 'rb'))

print_chunks_file_entropy(urlopen('https://github.com/mauricelambert/FastRC4/releases/download/v0.0.1/librc4.dll'), chunk_size=2048, colors=True)
print_parts_chunks_file_entropy(urlopen('https://github.com/mauricelambert/FastRC4/releases/download/v0.0.1/librc4.dll'), chunk_size=2048, part_size=512, colors=True)

Links

• Pypi
• Github
• Documentation
• Python executable
• Python Windows executable

License

Licensed under the GPL, version 3.