Tragedy Redux

Participants are provided with a 7zip file containing a file tragedy_redux. Upon inspection it has a magic bytes signature that doesn't signify any known file type.

Looking through the contents of the file for clues to it's type, it has a word/vbaProject.bin which means it's likely a word document with macro(s).

The magic bytes signature for word documents is 50 4B 03 04, so we can overwrite the previous incorrect signature. List of file signatures.

Opening the file in Microsoft Word or any software that can handle word documents, reveals a page with the dictionary definition of tragedy.

Checking the macros in the document we see some interesting VB code that's jumping through hoops to decode a string. You can sit and manually step through the code yourself, but I think it's best to run this and see what the output string is.

Now, we can take this code and modify as needed to fit the VB program we're going to run. We can also remove the If ActiveDocument.Name snippet as this isn't going to be triggered in a word document.

Running the code reveals a Base64 encoded string.

Decode the message using a Base64 decoder. Nice work!