filescanner.online
filescanner.online
urlscanner.onlineAnalyze PE & ELF Binaries Online.
Free, Deep, Private.
Full PE and ELF binary analysis — headers, sections, import tables, entropy, packer detection, MITRE ATT&CK mapping, and YARA rule matching. No installation, no account required.
Hash Verification
MD5, SHA1, SHA256 file hash checksums
Binary Analysis
PE & ELF binary parsing, sections, imports
YARA Scanning
17 rules across 13 threat categories
Malware Detection
70+ suspicious API & import detections
Deep binary analysis
What the PE/ELF Analyzer Shows
Understanding the internal structure of an executable is critical for malware analysis. filescanner.online parses PE and ELF binaries in full — from headers to import tables — and correlates findings with YARA rules, entropy analysis, and MITRE ATT&CK technique mapping.
PEWindows Portable Executable fields
| Machine architecture | x86 (PE32) / x64 (PE32+) / ARM |
| Compile timestamp | Original build date (suspicious if zeroed or future-dated) |
| Entry point | Virtual address of execution start |
| Sections | Name, virtual size, raw size, flags, per-section entropy |
| Import table | Every DLL and imported function name |
| Export table | Exported functions and ordinals |
| Digital signature | Authenticode signature presence |
| Checksum | Stored vs computed — mismatch flags tampering |
| Rich header | Compiler and linker version fingerprint |
| TLS callbacks | Pre-entry-point execution — common in packers |
| Overlay | Data appended after the PE — often embedded payloads |
| Imphash | Import hash for similarity matching |
ELFLinux/Unix Executable and Linkable Format fields
| Class | 32-bit (ELF32) or 64-bit (ELF64) |
| Endianness | Little-endian or big-endian |
| OS/ABI | Target OS (Linux, FreeBSD, Solaris …) |
| Machine | Architecture (x86_64, ARM, MIPS, RISCV …) |
| Entry point | Execution start address |
| Sections | Name, type, size, permissions, entropy |
| Dynamic imports | Shared library dependencies and imported symbols |
Shannon entropy per section
Encrypted or compressed sections have entropy above 7.2 bits/byte. High-entropy sections are a strong indicator of packing, encoding, or embedded shellcode.
MITRE ATT&CK mapping
Suspicious imports (e.g., VirtualAllocEx, WriteProcessMemory) are mapped to ATT&CK techniques — giving you actionable context on the file's capabilities.