FCAT

FCAT (First Chronicle Analysis Tool) parses the complete PE structure, DOS header, NT headers, optional header, and every standard data directory including import, export, resource, reloc, debug, TLS, load config, and the x64 exception table, written against the Microsoft PE/COFF spec directly rather than an existing library, partly because nothing available in C# handled bound imports and delay-load descriptors correctly.

Beyond parsing, it runs custom packer-detection heuristics: section names, virtual-vs-raw size ratios, and import table sparseness, stacked and weighted rather than trusted individually. A section named .MPRESS, or three near-empty imports paired with a bloated .text section, is a strong signal; none of these alone proves anything. The detector is tuned against a reference corpus of deliberately boring binaries so it does not flag every small utility as suspicious.

The entropy heatmap renders per-block Shannon entropy across the whole file, 256-byte windows, computed in batches with an explicit yield back to the browser event loop between them, so a 200MB file scans without freezing the tab. High-entropy regions usually mean compression or encryption; cross-referencing that against section type and import sparseness is what turns a noisy number into something actually useful for triage.