12-12-2018, 04:31 PM
The two xlsx were created by Office2007
xlsx A is related to xlsx B, because a identical template is used (invoice); B is created 6 months later;
the content inside that invoice template is ofcourse different
I can reproduce this also with Office365: I copy xlsx B, and name it xlsx C, change the content a bit, and save it. The encryption pwd stays the same.
I run office2john on A, B and C, and I get now three different hashes. As you precised correctly, the salt-value is for the three files the same.
Hashcat finds only the first one, when put together in one file. Seperatly, it finds all three.
xlsx A is related to xlsx B, because a identical template is used (invoice); B is created 6 months later;
the content inside that invoice template is ofcourse different
I can reproduce this also with Office365: I copy xlsx B, and name it xlsx C, change the content a bit, and save it. The encryption pwd stays the same.
I run office2john on A, B and C, and I get now three different hashes. As you precised correctly, the salt-value is for the three files the same.
Hashcat finds only the first one, when put together in one file. Seperatly, it finds all three.