Also it's entirely possible they purposefully left the files recoverable via XOR instead of DES [1] because all they really care about is getting $16 from you, not punishing you if you don't.

[1] a distinction the author was clearly aware of as it claimed DES was used in the ransom note