When I wrote about the internal file format of protected spreadsheets, I mentioned a simple 16-bit hash for .xls files in diary entry “16-bit Hash Collisions in .xls Spreadsheets” and a complex hash based on SHA256 for .xlsx files in diary entry “Protected OOXML Spreadsheets“.

But what happens if you open a protected spreadsheet in OLE format (.xls) and save it in OOXML format (.xlsx)?

In that exceptional case, the XML protection elements in the OOXML file will store the 16-bit hash taken from the OLE file:

Didier Stevens
Senior handler
blog.DidierStevens.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.