Чувак, где мой флаг? (Dude, Where's My Flag?)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-01-06 | Status: Solved Techniques: binary_analysis, sfx_extraction, unicode_filename_detection, xor_decryption

Summary

Task: Analyze a suspicious file from an infected computer. Solution: Detected Unicode RLO spoofing in filename (.exe disguised as .jpg), extracted WinRAR SFX archive, and decrypted XOR-encoded flag from embedded malware.

Чувак, где мой флаг? (Dude, Where's My Flag?) - HackerLab

Description

Один из компьютеров компании был заражён. Мы подозреваем, что во всём виновата эта картинка из архива. Но не совсем уверены.

File: where_is_my_flag.zip

Analysis

Step 1: Extracting the Archive and Detecting Unicode Spoofing

After unpacking the ZIP archive, a file with a suspicious name containing Unicode character U+202E (Right-to-Left Override) was found:

x‮gpj.exe

This character reverses text display from right to left, making the filename visually appear as .jpg when it's actually .exe. A classic social engineering trick to deceive users. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

How to detect:

 bash read-only • copy allowed Copy
# Show hex representation of filename
ls | xxd
# Or use Python
python3 -c "import os; print([hex(ord(c)) for c in os.listdir('.')[0]])"

Step 2: Analyzing the Executable

 bash read-only • copy allowed Copy
file x*
# PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive

The file turned out to be a WinRAR SFX (Self-Extracting Archive). RAR 5.x signature found at offset 470528:

 bash read-only • copy allowed Copy
xxd x*.exe | grep -i "Rar"
# 00072c00: 5261 7221 1a07 0100  Rar!....

Step 3: Extracting SFX Archive Contents

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
# Extract RAR portion
dd if=x*.exe bs=1 skip=470528 of=inner.rar
# Or use 7z/unar directly
7z x x*.exe

Archive contents:

• flag.jpg - Meme from "Scary Movie" with text "When will you give me the flag?" (red herring)
• chuvak.wav - Audio file (red herring)
• prg.exe - Main malicious program

Step 4: Reverse Engineering prg.exe

Analyzing strings in the binary:

 bash read-only • copy allowed Copy
strings prg.exe | grep -i encrypt
# xorEncrypt

Disassembly revealed the xorEncrypt function and encrypted flag bytes in the main() function: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Encrypted bytes:

02 0e 05 04 03 18 3a 02 29 34 17 01 2a 1e 27 2d 01 26 1e 01 2f 25 1e 35 20 12 2a 3c

XOR key: 0x41 (ASCII 'A')

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Flag decryption from prg.exe
XOR with key 0x41
"""

encrypted = bytes([
    0x02, 0x0e, 0x05, 0x04, 0x03, 0x18, 0x3a, 0x02,
    0x29, 0x34, 0x17, 0x01, 0x2a, 0x1e, 0x27, 0x2d,
    0x01, 0x26, 0x1e, 0x01, 0x2f, 0x25, 0x1e, 0x35,
    0x20, 0x12, 0x2a, 0x3c
])

key = 0x41  # 'A'

flag = bytes([b ^ key for b in encrypted]).decode()
print(flag)

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Attack Techniques

Unicode RLO (Right-to-Left Override) - U+202E

Used to disguise file extensions:

• malware[U+202E]gpj.exe displays as malwareexe.jpg
• Victim thinks they're opening an image but runs an executable

RLO Detection:

 python read-only • copy allowed Copy
import os
for f in os.listdir('.'):
    if '\u202e' in f:
        print(f"RLO detected in: {repr(f)}")

Attack Chain

ZIP archive
    └── x‮gpj.exe (appears as .jpg)
            └── WinRAR SFX
                    ├── flag.jpg (decoy)
                    ├── chuvak.wav (decoy)
                    └── prg.exe (malware with XOR-encrypted flag)

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍