AVL Code
All cases
#016 · Sample Analysis

Case study · Sample Analysis

Analysis of a CryptoLocker Ransomware Variant (Rapid/Djvu)

You are an incident-response engineer assigned to identify a ransomware event, holding only a 116 KB Win32 executable sample. Complete the two steps in this article and you will receive a Critical-rated Markdown analysis report: the RSA-2048 offline encryption mechanism reconstructed, 6 categories of malicious behavior, a full IOC list (4 hashes / 2 ransom mailboxes / 20+ terminated processes), one YARA rule and an incident-response plan.

PE32 · 116 KB (116,736 bytes) · entropy 6.45, unpacked· Pure static · zero execution· Landi N2.5· Markdown report, 12,224 bytes· Critical

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Static identification — a full-chain Critical-rated ransomware report

    You paste only a SHA256 and ask for "a complete analysis report, title of your own choosing"; PE parsing, encryption-mechanism reconstruction, behavior identification, family attribution, IOCs and YARA all follow in one pass.

  2. 02

    Follow-up puts it on disk — a 12,224-byte Markdown file ready to archive

    You ask one follow-up — "what about the MD file, was it saved?" — and the report moves from the conversation into the workspace, its filename carrying the sample-hash prefix.

Task for AVL Code

cd58190be47ca6f416a3fa9c12a65eef70fbe80cfe8a0e098e9ef503b2e62377 Analyze this sample for me and write a complete analysis report. Give it a title based on the family and behavior — e.g. crypto-mining trojan analysis, ransomware analysis, and so on

Prerequisites: AVL Code is logged in; the sample is in the workspace as a file (only the hash is kept publicly for this case); writing the report requires a writable workspace

Reproduction materials at the end of this article Try it yourself ↓

Static Identification

The task assignment is a single sentence: paste the SHA256 and ask for "a complete analysis report", title of your own choosing. No analysis framework, no plan — the process advances on its own:

You type → AVL Code 
cd58190be47ca6f416a3fa9c12a65eef70fbe80cfe8a0e098e9ef503b2e62377 Analyze this sample for me and write a complete analysis report. Give it a title based on the family and behavior — e.g. crypto-mining trojan analysis, ransomware analysis, and so on
AVL Code runs → you see
Confirms the sample → PE parsing: 32-bit x86 GUI · 116,736 bytes · entropy 6.45 unpacked · MSVC-compiled
→ Extracts strings and IOCs, queries threat intel — "very critical information!"
→ Key evidence surfaces: embedded RSA-2048 public key · registry key Software\EncryptKeys · encryption extension .cryptolocker
→ Ransom notes and extensions: !DECRYPT_FILES.txt / two ransom mailboxes
→ Behavior strings: vssadmin shadow deletion · bcdedit recovery blocking · two scheduled tasks · per-service sc delete of security products · a 20+-process kill list
→ Attributes it to the Rapid/Djvu variant and delivers the full report under a self-chosen title

Report on Disk

The report is already in the conversation, but archiving and circulation need a file — and this last link is added by your one-line follow-up:

You type → AVL Code 
What about the MD file? Was it saved?
AVL Code runs → you see
Confirms status: "You’re right, the report hasn’t been saved as a file yet. Saving it now"
→ Writes 报告/CryptoLocker勒索软件分析报告_Rapid变种_cd58190b.md (12,224 bytes)

Try it yourself

Replay the whole process by importing the session into your workspace, or paste the instructions below in order (swap in your sample’s hash); after the report lands, verify the file:

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report 
› <sample SHA256> Analyze this sample for me and write a complete analysis report. Give it a title based on the family and behavior — e.g. crypto-mining trojan analysis, ransomware analysis, and so on
› What about the MD file? Was it saved?
› Get-Content "报告/<report filename>.md"
  • After the report lands, verify it with the Get-Content command above.
  • Pure static analysis, zero execution of the sample; work on suspicious samples in an isolated workspace, and the sample is provided by hash only. This session export contains no standalone tool-call detail blocks; the execution process in this article is compiled from the session narrative and the report body. For "the report was saved to disk", both pieces of evidence come from this same session — corroboration from the same source, not a mechanically independent source.

Next question: How do you wire the YARA rules plus the Software\EncryptKeys registry key, vssadmin shadow deletion and the Encrypter scheduled task into the detection line — and track their hit rate?