See what's inside a file

What this tool actually does It opens the file the way a security analyst would: it reads the internal structure without ever running the program. Nothing is executed, and nothing is sent anywhere. Think of it as an X-ray, not a taste test.

"Where the bytes actually are" (the coloured bar) A normal Windows program is almost entirely program. The cyan part is the program itself, the shaded part is data added after it ends. A little added data is usually a digital signature. A lot of it is usually one of two things: an installer that carries its own compressed files (normal, and signed), or a dropper carrying a hidden program inside (not normal). The bar shows you which shape you are looking at before any numbers are involved.

The entropy map (the colourful grid) Computers store normal program code in patterns that repeat, and compressed or encrypted data as near-random noise. This grid shows how random each part of the file is. Bright, blocky areas mean randomness, which is what you see inside packed, compressed, or encrypted content. A normal installer usually has a few bright blocks (its own compressed resources) and a lot of darker structured area. A file that is bright almost everywhere is usually hiding something.

Sections A Windows program is split into labelled blocks. .text holds the actual instructions. .rdata and .data hold fixed and changeable values. .rsrc holds icons, menus and dialogs. .reloc helps Windows load it. Those names are normal. Names you do not recognise are worth a second look, because packing tools often add blocks with their own names.

The four flag letters C means the block contains code. I means it holds set values. X means the processor is allowed to execute from it. W means the program can write to it while running. X and W together on the same block is the interesting one: legitimate compilers rarely produce that, and it is how a lot of malware unpacks itself or rewrites its own instructions.

Imports The list of things the program borrows from Windows. A normal application imports hundreds of functions. A very short list can mean the program is a small loader, or that it hides its real behaviour and fetches it later.

Compiled date The timestamp the program says it was built. It is easy to fake, so treat it as a hint rather than proof. A build date that is decades old or set in the future is a common sign of tampering or a reused builder.

What this tool cannot do This reads structure only. It never runs the file, so it cannot see what a program actually does when it starts. It will catch files that are built suspiciously, such as a small front-end carrying a hidden payload, and it will miss anything that is structurally tidy but behaves badly at runtime. A calm result here means the file is built normally, not that it is safe. Treat it as one honest signal, not a verdict.

Features (1,670) This is the same numerical fingerprint our detection engine builds when it looks at a file. We show the count to be transparent about how much of the structure is being measured. It is not something you need to read.