FIN7 Threat Hunting with Splunk: Ep.2 – Initial Access

Question

Question 8: Extract the hex-encoded image from the RTF that starts on line 108. Decode and open the resulting image file. What is the first line of text that appears in the image?
I facing difficulties answering this question, Please let me know how can I answer this?

samdickison · Answer

Hi Jiban​, which part of the question are you stuck on? Perhaps RobN​, SetecAstronomy​, steven​ or Fa11acy​ can help...

fa11acy · Answer

When you open the 2-list.rtf file, there's a huge block of hexadecimal code that begins at Line 108. You can copy and paste that into a separate file, then use a tool such as xxd to decode the hex and output it into a file. The decoded output should give you an image file which you can open - if it doesn't, then you've done it wrong. :)

Forum Discussion

FIN7 Threat Hunting with Splunk: Ep.2 – Initial Access

2 Replies

Featured Places

Help & Support Forum

Related Content

FIN7 Threat Hunting with Splunk: Ep.2 – Initial Access

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

APT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance

APT29 Threat Hunting with Splunk Ep.11 Q11

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

Recent Discussions

Guardduty: configuration and understanding findings lab not generating findings

Snort Rules: Ep.9 – Exploit Kits

ICS Malware: Triton ModuleNotFoundError: No module named 'pefile

Immersive: Threat Modeling Fundamentals

Trick or Treat on Specter Street: Ghost of the SOC