Savdid return codes encrypted Files

hi there,

we have switched to a new mail server, where we use amavis with savdid for the mail scanning.

Now, when someone sends an encrypted xlsx attached to an email, savdid fails with the following statement:

Sophos-SSSP av-scanner FAILED: CODE(0x427f160) unexpected , output="FAIL 0212 [...] \r\nDONE FAIL 0212 File was encrypted\r\n" at (eval 111) line 899.

But when somone send an encrypted zip attached to an email, savdid returns the following to amavis

(Sophos-SSSP) result: DONE OK 0000 The function call succeeded\r\n

Now we are wondering, why savdid obviously can scan some encrypted files and others not?