Inconsistency of entropy values to its graph

[dyussekeyev]

Dear developers,

When I analyzed a malware sample (MD5 73AFAC6E5799747168D49B8957AA757E) I have found an inconsistency of entropy values to its graph.

I tried to use various versions of the software: 3.02, 3.03 pre-release and 1.01. At the picture below I might see that the entropy of section '.data' is 2.4, but it does not correlate with a graph. Similar issues for other sections.

Is it a bug or normal behaviour?

Best regards, Askar.

[horsicq]

It is normal behavior. We are using 100 parts of the file to draw the graph. We need more parts to make the entropy of the section is more visible. I will make a custom parameter "count" to increase number of parts.

[dyussekeyev]

Understood. Thank you.

Could you please to modify the code so that one section should be not less that 1 part to ensure that it will be shown on a graph.

[horsicq]

Yes. I will make it. I will release version 3.03 in a few days, It will be in version 3.04.

[dyussekeyev]

Checked this sample again. Looks well in the 3.04. Thank you.