Inspection of the module (after MS-OVBA decompression) revealed that all the suspicious fields – "Issued By: ...", "Suspect: ...", "Address: ...", and "External harddrive labeled ..." – were XOR‐obfuscated.

Repeating-key XOR encryption simply XORs the plaintext with a short key, repeating the key as needed.

XOR is its own inverse: if we know any part of the plaintext we can recover the key at those positions

In our case, we recognized plaintext hints ("Detective", "flag", etc.) and brute-forced the 13‐byte XOR key by aligning those guesses against the ciphertext. This yielded the full key, which was then applied to decrypt each field.

🏴Flag

flag{c48219f5ea9d6bb54f7533edfc1a1124}