DensityScout
How to measure a files code density to identify potentially packed or encrypted applications using DensityScout.
This tool calculates density (entropy) for files of any file-system-path to finally output an accordingly descending ordered list. This makes it possible to quickly find (even unknown) malware on a potentially infected Microsoft Windows driven machine.
Entropy is used to represent a measurement of code density. Results with higher entropy indicate that a code is randomized, and no meaningful patterns can be identified. Low entropy results are likely indicative of normal or unpacked files. Usually, Microsoft Windows executables are not packed or encrypted therefore any abnormalities detected by running the DensityScout should be further investigated.
Tool Name | Version | MITRE ATT&CK Tactic | MITRE ATT&CK Technique | MITRE ATT&CK Sub-Technique |
---|---|---|---|---|
Build 45 |
DensityScout Help
Instructions
Search the Windows System32 Directory
{: .nolineno }
-pe
Searches for files with magic number “MZ” representing a PE file.-p 0.1
Instructs DensityScout to highlight files identified with a density below 0.1 on the command line screen. This is a quick reference to display data prior to the tools function completing.-o results.txt
Writes the full results set to a .txt file, matches from the-p
switch above will still be written to STDOUT.-r
Omitted from the above example, however when included searches the directory specified recursively. Listing the directory without -r only searches that directory without checking subdirectories.
Output
Sources
Last updated