Decoding single € (euro character) NTLM hash

[moxy]

Hello,

I have issues to decoding a single euro character "€" in a NTLM hash.
I'm aware that € in UTF8 is 0xE282AC and in UTF16LE 0xAC20

Hashcat works well with decoding MD4(UTF8): €-> 6XXfa8e71dbf050a5e7981632XXXdb38

hashcat.exe -a 3 -m 900 -w 3  6XXfa8e71dbf050a5e7981632ca3db38 ?b?b?b

but when I try with MD4 UTF16LE (NTLM): €-> EXXC5302DC302D6D00F765EDCXXX4920 it fails:

hashcat.exe -a 3 -m 1000 -w 3  0XX926b781938db4365d46adc7cfbcb8 ?b?b?b?b

I have been reading different post on hashcat forum but so far I have been unsuccessful. Any suggestions?

Thank you.

[DanielG]

Hashcat does not handle unicode well.

I set an windows account password to € (using alt+0128 or by copy/paste from wikipedia article about Euro sign). This gets me the NTLM hash 030926b781938db4365d46adc7cfbcb8 on the windows system (extracted using mimikatz). Which is also what I get if I manually MD4 the hex characters AC 20.

I then used hashcat.exe --a 3 --increment -m 1000 030926b781938db4365d46adc7cfbcb8 "?b?b?b?b" to get

Code:

030926b781938db4365d46adc7cfbcb8:€

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 1000 (NTLM)
Hash.Target......: 030926b781938db4365d46adc7cfbcb8
Time.Started.....: Tue Dec  2 14:19:30 2025 (0 secs)
Time.Estimated...: Tue Dec  2 14:19:30 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?b?b?b [3]
Guess.Queue......: 3/4 (75.00%)

This is weird because that would suggest it is 3 bytes.

When I run hashcat.exe --show -m 1000 030926b781938db4365d46adc7cfbcb8 --outfile euro.txt --outfile-format=3 I get 

Code:

e282ac

Which is not ac20 as expected.

[Banaanhangwagen]

Adding to this - for me - complicated encoding subject that as of v7.1 Hashcat cannot succesfully crack this anymore.
v7.0 does it well, as explained by DanielG.

Maybe worth opening an issue on Github ?
There is an interesting issue about the same problem from a couple of years ago: https://github.com/hashcat/hashcat/issues/3592