Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

AFAIK, the compound file format identifier is D0 CF 11 E0 A1 B1 1A E1, which is located in the offset 0 of the header, which has a length of exactly 512 bytes.

However that is not enough to get the boundaries of the md5 hash of the password. After that I plan to find a preimage in order to recover the document.

Can someone help me please? Thank you in advance.

share|improve this question

migrated from Jan 18 '13 at 16:48

This question came from our site for software developers, mathematicians and others interested in cryptography.

I've downloaded this specification, but I am not sure on how to extract the hash: – user4772 Jan 17 '13 at 17:45

You link the word97 specification for your 2000 document. I'm not sure if the file format changed, but luckily the encryption is the same.

I don't think you need the md5 hash (if there is one), you just want to break the encryption. It looks like there are word 97/2000 decryptors on the web (paid or freeware). My basic google search indicated that it's easier to break the proprietary hash + encryption (partially rc4) than to brute-force the password.

I wasn't going to link the page, but it wasn't hard to find.

Initially a unicode password is taken and some bytes appended, this password is passed through a varient of the standard md5 hash algorithm.

The non standard hash is tricky, and Im far from sure what benefit over standard md5 the modified md5 hash has.

share|improve this answer

Not sure on how to break it, but must not be impossible since there are tools that do it.

I see in this post that a zip crack tool can be used:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.