Office 2007 OOXML AES-128 — Hashcat Mode 9400

What changed with Office 2007

Office 2007 brought two big changes: a new file format (OOXML, formalised as ECMA-376) and a redesigned encryption scheme. OOXML files are ZIP containers — open one with 7-Zip and you will see XML files inside describing content, formatting, relationships, and embedded media.

When password protection is on, the whole OOXML structure is wrapped in an OLE2 container with the encrypted content stream. The content is encrypted with AES-128 in CBC mode by default. Microsoft calls this Standard Encryption and documents it in [MS-OFFCRYPTO] section 2.3.4.5.

Office 2007 also offered Agile Encryption as an option — extensible, XML-driven encryption metadata — but the default for Office 2007 password-protected files is the Standard scheme, which is Hashcat mode 9400.

• File extensions: .docx, .xlsx, .pptx
• Container: OLE2 wrapping ZIP+XML
• Cipher: AES-128 in CBC mode
• KDF: SHA-1, 50,000 iterations
• Encryption type: Standard Encryption

The 50,000-iteration key derivation

Office 2007 was the first Microsoft format to use a meaningfully iterated key derivation. The password is hashed with SHA-1, mixed with a per-document salt, and repeated 50,000 times. That figure was a deliberate cost choice: high enough to slow each brute-force attempt, low enough to keep a legitimate file opening in under a second.

By 2026 standards 50,000 SHA-1 iterations is low — current guidance (PBKDF2 in NIST SP 800-132, scrypt, Argon2) suggests 100,000 or more. Password verification rates on modern GPUs are therefore still very high, which means feasibility is governed by password complexity rather than by the derivation cost.

Why mode 9400 reduces to password strength

AES-128 has 2^128 possible keys — a space no realistic compute budget can cover. Specialised attacks on full-round AES-128 do not exist in 2026, so the cipher is effectively unbreakable by brute force.

Recovery therefore runs entirely at the password layer. A candidate password goes through the SHA-1 × 50,000 derivation, the resulting key decrypts a known portion, and the verifier hash matches if the guess was right. This is the same shape as any modern password-protected format.

In practical terms: a 6-character lowercase-only password falls in seconds (26^6 = 308M candidates × 50,000 iterations is tractable on a single GPU). A 14-character random password from a manager is effectively secure against any feasible budget. Password complexity decides everything.

Identifying mode 9400 files

The extension is a strong hint: .docx, .xlsx or .pptx with a password prompt is likely mode 9400 if the file was created in Office 2007, or by a tool using Office 2007's default encryption settings.

Open the file in 7-Zip or any ZIP browser. If it opens as a ZIP with [Content_Types].xml visible, it is not password-protected. If it shows a single EncryptedPackage file inside an OLE2 container, it is encrypted — and the EncryptionInfo stream says exactly which mode.

Tools such as msoffice-crypt or office2john from John the Ripper extract the password hash without needing the password. The output begins with $office$*2007* for mode 9400 — the 2007 is the version marker.

Office 2007 versus Office 2010 and later

Office 2010 changed two things: SHA-1 derivation iterations rose from 50,000 to 100,000 (mode 9500), and a new Agile option allowed AES-256 with arbitrary derivations. By Office 2013, the default was AES-128 with a SHA-512-based derivation (mode 9600).

Newer modes are categorically harder to recover than mode 9400, mainly because of the higher iteration counts. Same cipher, same overall design — just slower per password verification.

When to attempt recovery

Recovery is realistic when the password is short, predictable, dictionary-based, or when the owner remembers significant fragments. Without any hint, only common-pattern attacks remain feasible.

We do not publish recovery rates because they vary so much with password type. The honest position: tell us what you remember about the password's structure, run the free check, and decide on a paid attempt from the real signal the free phase produced.