Trying out WikiLeaks #QuestOfRandomClues 1

Apparently last October 04 (My Birthday too XD), Wikileaks celebrated their 12th year anniversary and to celebrate that momentous feat released a series of puzzles for their followers to try to decode on Twitter.

Some of you probably already know that I am into puzzles, riddles and CTF's specifically on "reconaissance". Like you will be given a random string or image and your job is to find out what it is all about or something like that and it seems that this #QuestOfRandomClues released by Wikileaks last week was kind of similar to that. So I gave it a try to see if I can correctly decode what they are hiding.

QuestOfRandomClues #1

e4b889e4ba94e4b883e4b880e4b883e4ba94e585ade4b889e585ab2c20e4b880e4b889e4b99de4ba94e4b889e59b9be4b99de4ba8ce585ade585ad

My Approach

Looking at the string above, it is quite easy to guess what kind of encoding was used to hide whatever information they are trying to hide. Since it only has the numbers 0-9 and the letters A-E it is most likely HEXADECIMAL.

Using my favorite decoder online tool, CRYPTII the string seems to be Chinese numbers. (I know a little mahjong so I know those characters lol)

And it seems I am right, it is indeed Chinese numbers which gives us the second clue we need for this quest: 357175638, 1395349266

The next step is probably the hardest part of this quest as that pair of numbers could mean anything. So what I did next was check the mole image above to look for supporting clues that may help us decode that number.

So I checked on HIEW if there is anything immediately visible on it and got nothing:

Next I tried EXIF (I used Jeffrey's Image Metadata Viewer) and it seems there really is nothing on the image provided. Also tried stegsolve, LSB and still got nothing so I gave up! Lol jk

The thing about two numbers separated by comma is that on CTF's it's mostly coordinates. So I tried all possible combinations on MapQuest. Gotta move that decimal point XD

3.57175638, 1.395349266
3.57175638, 13.95349266
3.57175638, 139.5349266
35.7175638, 1.395349266
35.7175638, 13.95349266
35.7175638, 139.5349266
Luckily I got something on that coordinate
https://www.mapquest.com/latlng/35.7175638,139.5349266

And looking at it on Google Map:

And on Street View

Unlike CTF's where the correct answer is usually enclosed by "ctf{ }", I don't know when to stop looking for more clues for this #QuestOfRandomClues by Wikileaks. Lol So yeah there must be something in that building.