We get the following image and from the name of the challenge we are probably going to use binwalk.

Weird purple ghost character with glasses and a straw image given in the challenge

The file and exiftool don’t give us any hints so we just move to the binwalk command where we find that there is another a zlib file and png image embedded.

$ binwalk PurpleThing.png

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             PNG image, 780 x 720, 8-bit/color RGBA, non-interlaced
41            0x29            Zlib compressed data, best compression
153493        0x25795         PNG image, 802 x 118, 8-bit/color RGBA, non-interlaced

After spending a lot of time trying to find anything useful in the zlib compressed file nothing seemed to give me any hints so I just moved to the png file. This was a bit tricky to extract and it can be done with some flags of the binwalk tool but I just went on and used dd since it was much easier.

$ dd if=PurpleThing.png of=out bs=1 skip=153493
11309+0 records in
11309+0 records out
11309 bytes (11 kB, 11 KiB) copied, 0.410729 s, 27.5 kB/s

The dd command took as input (if) the png file and produced the out file as output, also I instructed it to skip the first 153493 bits and output the rest.

The out file was indeed a png file and by opening the images we successfully find the flag ABCTF{b1nw4lk_is_us3ful}

PS. It is worth mentioning that the a zlib compress file found can be found in normal in png images since it is a way to compress the data of an actual image.