Why is entropy measurement useful in static malware analysis?

• A. High entropy suggests packing or obfuscation; useful to flag potentially packed malware.
• B. Entropy measures program speed.
• C. Entropy confirms code is clean.
• D. Entropy determines file size.

Answer: (A)

Entropy measures how random the data in a file is. In static malware analysis, that randomness is a clue: packed or obfuscated code replaces readable instructions with compressed or encrypted data, which looks highly random. When a binary or a section shows high entropy, it flags that the payload may be packed or encrypted, guiding you to unpacking, decrypting, or more in-depth analysis to see what the program actually does. This makes entropy a useful triage tool for identifying suspicious samples and deciding where to dig deeper. Entropy, by itself, does not measure how fast code runs, it does not certify that code is clean, and it does not indicate file size.