Well, 'researching' ...
I discovered by accident that a few JPEGs I had been repairing for a client were actually JPEGs affected by a STOP/DJVU variant (checked and confirmed with https://id-ransomware.malwarehunterteam.com/).
So then the only logical conclusion was that the file was not entirely encrypted, else I would not have been able to make the JPEG data visible. Only a portion of the files is encrypted by variants of STOP/DJVU. It can clearly be seen in attached picture, where JPEG-Repair strips any file from any data that prevents a JPEG decoder from decoding data.
So idea is, in general, that for specific file types it may be possible to strip it from corrupt/encrypted data + glue in a valid header + maybe restore some pointers within header to point to the data that survived encryption.
The larger the file, the smaller the effect of the encryption. Based on what I have seen STOP/DJVU variants encrypt 150 KB or so in digital photos (JPEG, CR2, NEF).
I am by no means a ransomware specialist, and the idea of repair is only even possible on data that wasn't actually encrypted.
| Attachments: |
|
2020-01-03 (1).jpg [ 78.89 KiB | Viewed 14681 times ] |