Running foremost picks up a zip folder.

foremost -o moon.out moon.png

The zip has a flag.txt and is password protected. After failing to find a password, I tried "moon". What do you know.

Flag.txt has sun{0kay_it_is_a_m00n}.

Original writeup (https://github.com/tsunnyday/ctf-writeups/tree/master/SunshineCTF_2016/moon).