Back to writeups
FlagYardforensicsMediumsolved

SM

12 Jul 2026 · by 0xIDA

Solvers

SM

Author: 0xIDA
Platform: FlagYard · Category: forensics · Difficulty: Medium

Solvers

Summary

Memory dump after Office social-engineering: malicious Word macro splits the flag into two VirtualAlloc buffers (FlagY{ + MD5 + }). Reconstruct by carving VBA source (or both regions), not a single strings hit.

Solution

Step 1: Process / injection context

Challenge text warns this is not a typical string search. Writeup path:

vol -f SM_Challenge.raw windows.pstree   # WINWORD.EXE PID 5644
vol -f SM_Challenge.raw windows.malfind  # RWX region @ 0xd540000 starts with FlagY{

malfind only shows the first allocation (FlagY{ + padding). The MD5 body is in a second region (0xd550000 per macro MsgBox).

Step 2: Recover both byte arrays from VBA in the dump

Carved macro source from SM_Challenge.raw:

flagPart1Variant = Array(&H46, &H6C, &H61, &H67, &H59, &H7B)
flagPart2Variant = Array(&H33, &H62, &H31, &H65, &H39, &H61, &H34, &H64, _
  &H64, &H36, &H32, &H61, &H64, &H35, &H66, &H61, &H62, &H33, &H35, &H31, _
  &H31, &H33, &H65, &H63, &H35, &H37, &H64, &H37, &H66, &H36, &H39, &H30, &H7D)

p1 = bytes([0x46,0x6C,0x61,0x67,0x59,0x7B])
p2 = bytes([0x33,0x62,0x31,0x65,0x39,0x61,0x34,0x64,0x64,0x36,0x32,0x61,
            0x64,0x35,0x66,0x61,0x62,0x33,0x35,0x31,0x31,0x33,0x65,0x63,
            0x35,0x37,0x64,0x37,0x66,0x36,0x39,0x30,0x7D])
print((p1+p2).decode())

Also visible near macro telemetry: First part ... D540000 / Second part ... D550000 and ASCII MD5 3b1e9a4dd62ad5fab35113ec57d7f690.

Flag

FlagY{3b1e9a4dd62ad5fab35113ec57d7f690}

Tools

  • Volatility 3 (pstree, malfind) — optional for context
  • Python carving of VBA byte arrays from .raw

Key takeaway

Split-flag / multi-allocation macros defeat naive FlagY{...} greps. Recover the generator (VBA arrays) or both allocated buffers and concatenate.