Link: https://blueteamlabs.online/home/investigation/80

As part of their regular job, ZYX Company employees need to deal with a lot of Excel files. One day, Thomas who is the Security Champion of the Finance Team received 2 Excel files that looked suspicious. Being a security-conscious individual, Thomas sent those files to the RE team for further examination.

Scenario Description

Conclusion

Like most BTLO investigations, there is always at least one question where the formatting or question doesn’t make sense. In this case, the “string that confused the analyst” was what perplexed me, as nothing seemed ‘confusing’ to me.