I think there are number of way to solve it, as someone say there is a VPN needed, but I solved it without VPN.
Its not an EASY challenge.
Honestly, one of the most fun challenges and rewarding challenges Iāve done. Absolutely destroyed me. Thank you @sooperc0w for pulling me out of the weeds. Also, thank you @0xdf for the challenge!
Dm for nudges!
Solved it, but not in a very intelligent wayā¦ Would love to see a writeup of this
Hey I solved with office but want to know without office can someone DM ?
Glad to hear so many people enjoyed this one. Itās based off a real phishing document used by a prolific cyber-crime gang.
Some tips Iāll through out:
- You donāt need to resolve anything.
- You donāt need office. There are tools out there to dump office documents and their pieces from linux. There are also parts where having office will make this somewhat easier.
1 Like
This was harder than most boxes!
When you find what the evil document is doing, you can pare that down to something that is ALMOST readable, but definately works when you run it.
Inspect all of the things, and donāt skip any of them. Assume everything is important.
I just finished doing this challenge but without any static analysis, is there any official writeup regarding this challenge? Appreciate if any of you guys that done through static to share writeup. Thanks!
Same as many here, I got a bunch of urls and some decimal list with PS yet I donāt get whatās nextā¦
dm for any nudges
Finally got it after a couple of days! First time doing malware analysis, so it was quite a learning experience for me 
Thanks for a cool challenge.
Really entertaining challenge! Thanks a lot @0xdf! Finally got the flag but doing dynamic analysis. Iād love to know how to solve it doing static analysis only.
DM me if you need a hint.
Hi, I think Iāve reached the last phase, but I canāt decode the output. I donāt want to spoil anything so I cannot go any deeper. However some hint about that stage?
Solved. Best advice: donāt overthink this one (Thatās what I did). You can go pretty far down the rabbit hole. Just remember, itās an EASY challenge.
Hi @R3v4ng3l I am working on this EMO challenge and not able to solve it. Any hint?
Hey nice seeing ya in my scripts @0xdf
Great challenge, thanks a lot!!
Iām surprised that I actually enjoyed browsing vba / powershell!
My static approach was soooo clunky, I couldnāt help but find out what that next line was doing ^^ā
Hello, Iām stuck on this challenge. Like others have said I have got a bunch of non working urls. What else am I missing. Would appreciate a nudge.
Right. I got to the point where I can read the ps, yet no flags. What th. Spent much more time on this, than it deserves, can anyone give me a nudge?
Why canāt I decode this long base64 powershell command??? i really need to get some training on decoding.
Do I really have to deobv all the marcos found?