Running foremost picks up a zip folder.
foremost -o moon.out moon.png
The zip has a flag.txt and is password protected. After failing to find a password, I tried "moon". What do you know.
Flag.txt has sun{0kay_it_is_a_m00n}.