(04-12-2016, 04:13 PM)stepMode Wrote: Are you able to reproduce this with any other hash?
I try to make a test file, and cudahashcat worked to it.
But for the orginal file, it can not get the RC4.
I found that when I open the orginal file in passware, passware show that the file is "Microsoft Base Cryptographic Prider v 1.0. 128 bits", and test file is 40 bits.
When using office2hashcat.py to analyze these two files, the output hash are all start with $oldoffice$3.