EXE Analyzer
Drop in a Windows program (.exe, .dll or .sys) to see whether it is packed, encrypted or obfuscated, what built it, the web addresses and IP addresses inside, its signature, and as much of its source as the file gives away. Nothing runs and nothing is uploaded.
How to Use
- Drop a Windows program (.exe, .dll, .sys or .scr) on the box, or click it to choose one. It is read in your browser and never run.
- Read the three verdicts at the top: packed, encrypted, obfuscated. Each one lists the evidence behind it.
- Check “Built with” and the signature to see what made the file and who signed it. A signature is read here, not verified: Windows decides whether it trusts it.
- Open the report below for the sections, imports, web and IP addresses, readable text, and any source names the file gives away.
- Copy the SHA-256 hash to look the file up on a scanning service if you want a second opinion, or download the whole report as JSON.
The report appears here once a file is read.
Worked Example
A UPX-packed program. We packed a copy of ripgrep (a 4.0 MB search tool written in Rust) with UPX 5.2.1. The result is 1.4 MB. Its section “UPX0” takes 2.7 MB in memory but 0 bytes in the file; the program starts in “UPX1”, a 1.4 MB section with an entropy of 7.94 bits per byte; and it imports just 8 functions, including LoadLibraryA and GetProcAddress. The original has 127 imports and a code section at 6.26. Verdict: packed, by UPX, and since UPX is reversible, upx -d gives the original back.
Encrypted, not just compressed. A protected program we examined held 15.8 MB in one section with every byte value almost exactly equally common: a chi-square of 253 over 64 KB samples, where true random noise gives 255 ± 23. Compressed data is never that even (the UPX code above scores 5,811), so the payload is encrypted. Nothing inside can be read until the program decrypts itself at run time, which is why it showed no web addresses at all.
The common mistake: high entropy means packed. yt-dlp, an open-source downloader built with PyInstaller, is 17.0 MB, and 16.7 MB of it has an entropy of 8.00. But that data sits after the program, as a zlib archive of Python files (chi-square 434), and the program’s own code section looks normal. That is a bundle, not packing, and the tool reports it as “compressed archive appended”.
Show Work
Formulas
Why Programs Get Packed
Executable packers began as a way to save space: a packed program carries a small unpacking routine and its own code in compressed form, and rebuilds itself in memory when it starts. UPX, the best-known free packer, published its first public beta (version 0.05) on 26 May 1998, written by Markus Oberhumer and László Molnár on the basis of their earlier packers, according to the project’s own change log. The same trick later served copy protection, anti-cheat systems and, inevitably, malware that wants to keep antivirus scanners from reading its code. Commercial “protectors” go further and encrypt the code or translate parts of it into instructions for a private virtual machine.
The two measurements this tool leans on are older than computers that run EXEs. Claude Shannon defined information entropy in 1948, in “A Mathematical Theory of Communication”; Karl Pearson published the chi-square goodness-of-fit test in 1900. Together they answer “is this data random, compressed or ordinary?” from nothing more than how often each of the 256 byte values appears. The structure itself, sections, imports, signatures and debug records, comes from the Portable Executable format that Microsoft documents for Windows programs.
About This Analyzer
The analyzer reads the whole file in your browser: the PE headers and sections, the import table, the Rich header and debug record, version information, the Authenticode certificates (read, not verified: Windows decides whether it trusts a signer), any data appended after the program, and every readable string. It measures entropy across the file and runs a chi-square test on high-entropy regions, matches packer, protector and toolchain signatures from the same engines as the File Inspector, and recovers what names it can: Go modules and functions, Rust crates, .NET classes and methods, PyInstaller scripts and the PDB path.
It never runs, unpacks, decrypts or de-virtualizes anything, and it is not an antivirus: a clean report does not prove a file is safe, and a packed one is not proof of malice. The web addresses and IP addresses are shown exactly as found, and IP addresses are classified on your device without any lookup. Nothing you drop here leaves your computer. For checking a file’s hash against antivirus engines, copy the SHA-256 from the report.
Related tools: File Inspector, Hex Editor, and Checksum Calculator.
Frequently Asked Questions
How can you tell if an EXE is packed?
Several signs together. Normal machine code has an entropy of about 5.5 to 6.8 bits per byte; packed or encrypted code is above 7.2, close to the 8.0 maximum. Packed programs also tend to have code sections that are empty on disk but large in memory, start running outside their main code section, and import only a handful of functions, often just LoadLibrary and GetProcAddress. A UPX-packed copy of ripgrep shows all of these: 7.94 bits/byte, a 2.7 MB section that is 0 bytes on disk, and 8 imports.
Can this tool show me the source code?
Not the source itself: a compiled program holds machine code, not the text it was written in. It does recover the names a file gives away. Go programs list their module, dependencies, source file names and function names; Rust programs name their crates; .NET programs keep class and method names; PyInstaller bundles name their Python scripts and keep their strings; many programs record the PDB path of the developer’s project folder. A packed or encrypted program hides all of this until it is unpacked, which this tool does not do.
Is it safe to drop a suspicious file here?
Yes. The file is read as bytes by your browser and never executed, and it is not uploaded anywhere. Reading a program cannot run it. Just don’t open the file itself afterwards if the report worries you.
How do you tell encrypted data from compressed data?
Both look random at a glance, with entropy near 8 bits per byte. A chi-square test on the byte counts separates them: well-encrypted data is as even as true random noise, about 255 for 64 KB samples, while compressed data is lumpier. In our tests an encrypted payload scored 253, the UPX-compressed code 5,811, and the zlib archive inside a PyInstaller program 434.
Does packed mean the file is malware?
No. Installers, games with anti-cheat, commercial software protected against copying, and anyone who used UPX to make a file smaller all produce packed programs. Malware is packed often too, to hide from antivirus, so a packed file from an unknown source deserves care: check who signed it, where it came from, and its SHA-256 on a scanning service.
How do I use the EXE Analyzer?
Simply type your numbers and read the result, which refreshes the instant you change something. There is nothing to submit and nothing to wait for.
Does it cost anything or need an account?
No. The tool is completely free, there is no account to create, and it keeps working offline after the page first loads.
Is anything I type uploaded?
No. The tool works entirely on your device, so the values you enter never leave your browser.
Common Use Cases
A file a friend sent you
An EXE with random section names, a 24 MB section at entropy 7.89 and one import per DLL is a protected program: the tool shows why, without running it.
Checking a download
See the publisher on the signature (GitHub, Inc. on the gh CLI) and the web addresses inside before you run something new.
Before you publish your own build
Find what your EXE gives away: a PDB path such as C:\Users\you\source\repos\Project, Go module names or Rust crate versions.
Triage at work
An attachment with a Discord webhook address, “Login Data” and “Local State” in its text is worth escalating; the tool lists those strings and the hash to report.
Learning how programs are built
Compare a Go program (one import DLL, 46 functions) with a Visual C++ one (50 DLLs, 315 functions) and see how each toolchain shapes the file.
Last updated: