# File entropy (analysis.entropy)

analysis.entropy: malcat.Entropy

  The `analysis.entropy` object is a `malcat.Entropy` instance that gives you access to the entropy of the file, as computed and cached by the Entropy computation algorithm. Also the different file hashes (crc32, md5, sha1, sha256 and tlsh) are accessible through this item.

Note that in addition to this documentation, you can find usage examples in the sample script which is loaded when you hit `F8`.

## Entropy costs

Since Malcat’s Entropy computation is pretty optimised and cache-based, it is very cheap to query entropy using the `malcat.Entropy` object. If you query the entropy of a file interval, it won’t be as precise as a normal Shannon entropy computation, but the result will be instant (O(1)). So use it and abuse it in your scripts and custom anomalies!

## The Entropy object

class malcat.Entropy

  This class allows you to query the file’s pre-computed entropy. It gives you also access the file’s different hash values.

  __getitem__(interval)

    compute the entropy of a given file interval. The entropy is given as a number between 0 (lowest entropy) to 255 (highest entropy, random data)

        mid_address = analysis.map.from_phys(analysis.file.size // 2)
        print(f"Entropy of first half of the file: {analysis.entropy[:mid_address]} ({100*analysis.entropy[:mid_address] // 255}%)")
        print(f"Entropy of second half of the file: {analysis.entropy[mid_address:]} ({100*analysis.entropy[mid_address:] // 255}%)")

    Parameters:

      interval (slice) – effective address interval

    Return type:

      int (between 0 and 255)

  crc32: str

    the hexadecimal representation of the crc32 of the file

  md5: str

    the hexadecimal representation of the md5 of the file

  sha1: str

    the hexadecimal representation of the sha1 of the file

  sha256: str

    the hexadecimal representation of the sha256 of the file

  tlsh: str

    the hexadecimal representation of the tlsh hash of the file