Can only find one hash of two - Office 2013
#5
The two xlsx were created by Office2007

xlsx A is related to xlsx B, because a identical template is used (invoice); B is created 6 months later;
the content inside that invoice template is ofcourse different

I can reproduce this also with Office365: I copy xlsx B, and name it xlsx C, change the content a bit, and save it. The encryption pwd stays the same.
I run office2john on A, B and C, and I get now three different hashes. As you precised correctly, the salt-value is for the three files the same.
Hashcat finds only the first one, when put together in one file. Seperatly, it finds all three.


Messages In This Thread
RE: Can only find one hash of two - Office 2013 - by Banaanhangwagen - 12-12-2018, 04:31 PM