CTF Writeup: Batch Downloader

A malicious batch file has been discovered that downloads and executes files associated with the Laplas Clipper malware. Analyze this batch file to understand its behavior and help us investigate its activities. Introduction Happy holidays everyone! The new year is quickly approaching and I have no plans on slowing down. Today we’ll be going through another LetsDefend challenge - Batch Dowloader. Batch files were my introduction into programming and computing. I wrote some small batch files to copy files and easily install MineCraft mods, something along those lines. The number of resources online that were available even back then in the early 2000s made me want to get into software development. Looking back, Python might have been better to learn, but I’ll still have those memories of writing my first Batch file. ...

December 28, 2025 · 7 min · 1489 words · Ligniform

Advent of OSINT 2025: Day Seventeen

Day Seventeen Question one Another homonym! Together they give the solution. I was very confused when I first read this. There’s another hint that reads: Hint: I have the homonym, I know why he is famous, and I am stuck Remember Nike’s slogan. That clears nothing up. I used Yandex to run a reverse image search and found the full image: Looks like a neat little band. The Yandex results also led me to this page that reveals their full name: Kazuhisa Hashimoto ...

December 17, 2025 · 2 min · 297 words · Ligniform

Advent of OSINT 2025: Day Sixteen

Day Sixteen Yesterday was pretty easy. I got lucky finding that larger image right away that gave us all the clues we needed for the two questions. Let’s hope that today goes a similar way! Question one During the autumn of 2025, the UK Maritime Trade Operations (UKMTO) issued a warning regarding a maritime incident that occurred near the following coordinates: 12.381162, 46.468557. The cause of the incident, however, could not be determined with certainty. What is the IMO number of the vessel involved? ...

December 16, 2025 · 2 min · 301 words · Ligniform

Advent of OSINT 2025: Day Fifteen

Day Fifteen Question one This photo shows Santa Claus receiving his pilot’s licence. The seated man holds the very first licence issued by this organisation. To whom had this first licence originally been offered? A quick reverse image search shows this other version of the image. The description of the image is as follows: Santa Claus receives aeroplane pilot’s license from Assistant Secretary of Commerce. Although there may not be sufficient snow for his reindeer sleigh, Santa Claus will still be able to deliver his load of presents on time this Christmas by using the air route. The old saint called at the Commerce Department in Washington today where he is shown receiving an aeroplane pilot’s license from Assistant Secretary of Commerce. for Aeronautics William P. MacCracken, while Clarence M. Young (right) Director of Aeronautics, Department of Commerce, looks on. Airway maps and the assurance that the lights would be burning on the airways Christmas Eve were also given to Santa ...

December 15, 2025 · 2 min · 359 words · Ligniform

Advent of OSINT 2025: Day Fourteen

Day Fourteen Question one Delivering presents to all the children of the world is no easy task but this group looks ready for the challenge! Who needs sleighs and reindeers when they can have airplanes? Identify the airline, the make and model of the aircraft seen in the picture. A quick reverse image search led to this German article which provides what looks like an alternative angle from the original image posed in the question: ...

December 14, 2025 · 2 min · 333 words · Ligniform