Презентация из Трои (Presentation from Troy)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: homoglyph_detection, office_document_forensics, static_reverse_engineering, xor_decryption

Summary

Task: Analyze a PowerPoint presentation containing a hidden trojan. Solution: Extract PPTX as ZIP, find PE executable hidden with Unicode homoglyph filename, reverse engineer XOR decryption with key 0x41.

Презентация из Трои — HackerLab

Description

Forensics challenge with a PowerPoint presentation containing a hidden trojan.

Analysis

1. Examining the PPTX Archive

PPTX files are ZIP archives. Extract to analyze the internal structure:

 bash read-only • copy allowed Copy
unzip for_business.pptx -d extracted/

2. Discovering the Hidden File

When analyzing the contents of ppt/media/, a suspicious file was found:

• imаge11.png — the letter 'а' in the filename is Cyrillic (U+0430), not Latin 'a' (U+0061)

This is a Unicode homoglyph technique to hide the file from regular searches. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

3. File Type Analysis

 bash read-only • copy allowed Copy
file ppt/media/imаge11.png
# PE32+ executable (console) x86-64, for MS Windows

The "PNG" file turned out to be a Windows PE64 executable — a Trojan horse (reference to the task name "Troy").

4. Reverse Engineering the Executable

Disassembly with objdump revealed:

• A buffer of 33 encrypted bytes loaded via movb instructions
• XOR decryption loop with key 0x41
• Code to write the decrypted value to Windows registry:
  • Path: Software\MyApplication
  • Name: NotV1rus ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Extracting the File with Unicode Name

 python read-only • copy allowed Copy
import zipfile

with zipfile.ZipFile('for_business.pptx', 'r') as z:
    for name in z.namelist():
        if 'image11' in name.lower() or 'imаge11' in name:
            print(f"Found: {name!r}")
            z.extract(name, 'extracted/')

Decrypting the Flag

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# XOR decryption with key 0x41

encrypted = [
    0x02, 0x0e, 0x05, 0x04, 0x03, 0x18, 0x3a, 0x31,
    0x31, 0x35, 0x39, 0x1e, 0x01, 0x33, 0x22, 0x29,
    0x70, 0x37, 0x04, 0x1e, 0x01, 0x2f, 0x05, 0x1e,
    0x33, 0x73, 0x26, 0x08, 0x32, 0x35, 0x13, 0x38, 0x3c
]
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

decrypted = ''.join(chr(b ^ 0x41) for b in encrypted)
print(decrypted)
# CODEBY{REDACTED}

Techniques

1. PPTX/Office Document Forensics — extracting as ZIP to analyze structure
2. Unicode Homoglyph Detection — searching for visually similar characters from different alphabets
3. PE Executable Analysis — static analysis of Windows executables
4. XOR Cipher Decryption — classic obfuscation method in malware ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍