Some time ago I read an article that mentioned that it is possible for some ransomware to change the magic numbers of a file (that makes sense). However, the authors claimed that their method was better, because they calculated the entropy value of the file header and used that to distinguish between encrypted and benign files. However, the magic numbers are, as far as I know, part of the file header (so if they claim that ransomware can change the magic numbers, then it can also change the file header, right? So, why is this not a potential problem in their study?
In another study, this was mentioned:
However, since the header portion is only 8 bytes in size, the reliability of the data is not high. An intelligent ransomware can bypass the detection technique by not changing the 8-byte pattern.
They also state:
The trailer format section can most clearly distinguish between the normal encryption formats and ransomware-infected formats. The entropy value of 164 bytes of ASCII code was analyzed. The highest value of the entropy value of the normal file trailer format is lower than the smallest value of the trailer format entropy value of the ransomware infected file.
But in this case I wonder why the ransomware encrypts both the header and the trailer? I mean... it makes more sense to leave it intact (then the malicious software will not be detected), since it only contains metadata (the user cannot recover the file based on that metadata, so why would you encrypt it)?