In this challenge, we were given a .rar file. The first step I took was to extract it using WinRAR so that the folder could be accessed by VS Code. Within the folder, there was a .html file as follows:
If we look at the last line, there is a “strange” word which makes me suspect that this is a hint.
Next, I decided to go to https://www.prepostseo.com/tool/decimal-to-ascii, a website for converting decimals to ASCII.
The converter’s results made me even more suspicious, because among the many repetitions, there were some distinct differences, namely:
After that, I asked Copilot AI for help to decode that part, and finally I got the flag.
Flag
TCF{easy_phising_malware_analysis_gg}