Think like an analyst
Structure, metadata, streams, appended content, byte patterns, every layer can be evidence.
DIGITAL FORENSICS // REVERSE ENGINEERING // IOC EXTRACTION
THE DOCUMENT IS
NOT THE WHOLE STORY.
A seemingly ordinary PDF has reached your analysis queue. What a document viewer renders is only the surface. Your mission is to follow the evidence hidden inside the artifact, recover the concealed content, understand what the recovered logic is trying to do, and identify the network indicator used for its outbound communication.
MISSION // 01
Your assignment
Investigate the supplied PDF as a forensic artifact rather than as a normal document. Find what does not belong, reconstruct the concealed data, and examine the recovered code closely enough to determine its communication target.
FINAL OBJECTIVE
Extract the requested network IOC.
Do not submit the hidden payload itself.
Work safely
Use an isolated analysis environment. You should not need to contact or attack any external system.
Follow the chain
The visible document is the starting point. The answer appears only after you recover and inspect what is concealed.
STAGED ASSISTANCE
Hints, not spoilers.
Open them in order. Stop as soon as you have your next lead.
HINT 01 The renderer is not the investigator.
A PDF viewer shows what the document wants to display. Your forensic tools should tell you what the file actually contains.
HINT 02 Treat the PDF as a container.
Enumerate its structure and inspect anything unusual: objects, streams, embedded material, and data that may exist beyond the obvious document content.
HINT 03 Unreadable does not mean random.
If recovered bytes look meaningless, look for repetition, recognizable boundaries, or a lightweight reversible transformation before assuming strong encryption.
HINT 04 The payload is evidence, not the flag.
Once you can inspect the recovered logic, focus on how it would communicate. The requested answer is the network indicator referenced by that behavior.
ORIGIN // CHALLENGE AUTHOR
BUILT FOR PEOPLE
WHO LOOK CLOSER.
This apprentice CTF challenge was created by Switch for hands-on cyber-security training. The scenario is designed to reward careful artifact inspection, methodical reverse engineering, and precise IOC extraction.
switch.ch