201205231544 u1rti

I have been going through some lesser known posts that are not in the auto analysis archive, amongst these I managed to find a solution for two of the posts u1rti(title 201205231544) which was originally found here (first two line breaks original, added linebreaks between the blocks for readability):

A858

4F69DF42D6763A6E D16CFA6690C11F68
3B58957B723C0C57 7F90A1A807AEDECC
DFBE482CC27EE535 34A67FB278BC9C8A

We can decrypt the hex after A858 using A858 as the password, yielding this:

8550A81BD25563992652FE4090DF3081B7F59718

The other post, u58gm (title 201205251618), originally found here (line breaks added for readability):

D71038F75D26DB33 80C864491A4EC70D
B7E5F7DB8DFB8252 0CCAC7D42694D2F6
AAEDEFB883C6EAD5 34A67FB278BC9C8A

This decrypts using the same key to an output similar to the one from the other post:

D881ED889FCE527960951A1225E856A84C88AEB2

Commands to decrypt both (be careful with the line breaks in the first command, they do matter in the echo and cut):

echo 'A858

4F69DF42D6763A6E D16CFA6690C11F68 3B58957B723C0C57 7F90A1A807AEDECC DFBE482CC27EE535 34A67FB278BC9C8A' \
  | cut -d '
' -f 2,3,4,5,6,7 \
  | xxd -r -p \
  | openssl enc -d -des-ede-ecb -K "$(printf 'A858' | md5sum | cut -d ' ' -f 1)"; echo

echo 'D71038F75D26DB33 80C864491A4EC70D B7E5F7DB8DFB8252 0CCAC7D42694D2F6 AAEDEFB883C6EAD5 34A67FB278BC9C8A' \
  | xxd -r -p \
  | openssl enc -d -des-ede-ecb -K "$(printf 'A858' | md5sum | cut -d ' ' -f 1)"; echo

Update: the first one is a torrent info-hash

Both outputs are 40 hex characters, which is exactly the size of a SHA-1 hash, and also of a BitTorrent info-hash. The first one turns out to be a real info-hash. A public torrent cache still has the .torrent file for 8550A81BD25563992652FE4090DF3081B7F59718, and hashing that file's info section with SHA-1 gives exactly the value from u1rti. So this is not a coincidence: A858 posted the identifier of that specific torrent.

The torrent itself:

• a single file called Think Like Your Customer.rar, 2,074,249 bytes (the title of a 2004 sales book)
• created with uTorrent 2.2.1 on 2012-05-23 at 18:45 UTC

u1rti was posted the same day at 22:46 UTC, four hours after the torrent was created.

Unfortunately it's a dead end: nobody is seeding it any more, so there's no way to see what the .rar really contained. The book title may well be a cover name; .rar files can hold anything. It's also possible A858 simply took the hash of someone else's torrent from that day.

The second hash (u58gm, two days later) isn't in any torrent cache I could find, and neither hash is in public SHA-1 lookup databases. Given the first one, it's probably also an info-hash of a torrent that was never cached.