Is this ransomware encryption or file corruption?

Question

I have backups of a user folder from an older drive that I am getting to organizing now and noticed files are either corrupted or encrypted.

File extensions and names are not changed, appears exe files are impacted, and with further analysis I have found some good files. The readable files are under about 655 bytes and I thought maybe it's a systematic if less than XXX then encrypt kind of logic. But I have also found a file of 651 is that unreadable and another of 655 is readable, it appears anything below 650 bytes is for sure readable and above 1kb for sure not readable.

Now there might be some readable bigger files but I have yet to find any suggestions for a Windows utility to do this?

Example of a unreadable readme.txt file of 766 byte:

RÐÜ`„ÜAŒŠz>‹ú ©<ìyF’”Îã¸b{¿>Q(9 <UЈÔIMút€*GŽ#'nÚÁ°…‹Œ#2ª0SŠ`2Aàè€aÕ›’jÚm5ñ®‰¡2æimºÈóÇæ{ž+݇û'åûÛs’ؘÒý};rÎÙœÈÐÓK;=œ¼œ¬û#W&Ì9»nI›˜´
²y…ë$c×wT<¼ò}Sð¨æfté¤:eÖ+;’®iƒŒ‘ØmÄ<XôÝçRg&y4é^~9®]¢ÓC _@jyäLj¸«`dŽ<ŽK2T®f°>!@°Çødâ!YnmîÞÜ=ˆp°f|×V?œÍwöáÍèÃ[W£OòJl<‰Q‡,ùü*sõúÎt¹    @ë¯öyþ1G>zkJkŸX`Ï4Ë r @‰ŒJ¯³;ü¹ï«19QñW•[×ÞBG_fl›¤lP`ؑ1∌#  àžˆû°9[xø•Ÿ}.y«A2ÖäkˆsÌ÷'op3|ËÕøëT
ª°^Òé÷ÄÉñ3@ˆÀC%Íõj„£”¾ŠãíïsVõ   J:ÂrËá}Æw¾Ã&Eß9´Þ=y%¹
ù6 C¾MœlIöy€@kzQûˆK”158êòü¿­p¿õ3aò·ý‹p²PÁ€`”—s
.‚.ÉAô³ã´# ˜q
“ÂÂêËœ—4‡è'Š@Șw à¬Lyqo.ùƒ3Qž—çoœ¬<øÄÚÃ9äҮƽ†¦¬oVA h 9ÛVÝiÛ{%þ8›òNé’÷R7{8ñwŽ+Ç<GÏËr>Þul”,´YŸ<«îÈ™ø¬»z»~ö€ª`ÒŸ¯qoàÌHà–çD̾™NTJÜ_Áå1ävwò~·3ilàB™û"]o'z7Xò]]Wr%8r§·ñps¡$Ëhq'¸sÏc1ÖY'W6t¿:

RansomNoteCleaner reports CryLocker however the files it tags are just HTML type and if opened are all corrupted.

When I then scan with CryptoSerach for CryLocker encrypted files it finds 0 results.

Now also, if I think really hard I seem to vaguely recall an episode from a few years back of a ransomware pop-up, but you would think I would notice my files corrupted then.

This is some really nostalgic stuff from over a decade ago, so part of me wishes it is ransomware as that brings some hope of getting them back.

And yes, this was a rude awakening that I am now working out a process to have backups off backups in the cloud.

UPDATE:

This appears to have been a ransomware attack, I still don't which one however to my surprise I had good copies of all impacted files: lesson here, have backups of backups!

Answer 1

Your Shannon entropy score of 7.9 is very high (the scale goes from 1-8).

While I can't say for sure that this is the result of ransomware encrypting the files, it seems likely when we take into account your previous positive finding that identifies this as CryLocker.

I looked through my go to list of decrypters but didn't find one that specifically mentioned CryLocker. It's possible the identification of CryLocker wasn't quite accurate, and one of those decrypters could still help.