do you use 7-Zip software from https://www.7-zip.org/ to compress the file ?
I also noticed that your initialization vector is using the full 16 bytes while the 7-Zip application only uses 8 normally.
I think it would be enough to have an example hash which has exactly that property (data length < output length of AES decrypt) and a data length of course under the 320 KB limit to make it load in hashcat.
I'm not sure if this is easy to generate, because in my experience the compressed data is always smaller or equal size compared to the raw data (the LZMA2 algorithm is able to detect that case and not generate huge output if uncompressed data is smaller, I think).
Maybe this can only be generated with an alternative program ? or if this optimization is turned off ?
I also noticed that your initialization vector is using the full 16 bytes while the 7-Zip application only uses 8 normally.
I think it would be enough to have an example hash which has exactly that property (data length < output length of AES decrypt) and a data length of course under the 320 KB limit to make it load in hashcat.
I'm not sure if this is easy to generate, because in my experience the compressed data is always smaller or equal size compared to the raw data (the LZMA2 algorithm is able to detect that case and not generate huge output if uncompressed data is smaller, I think).
Maybe this can only be generated with an alternative program ? or if this optimization is turned off ?