hashcat Forum

Full Version: PDF Hash unidentified
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
I am having difficulty identifying a PDF hash.  I used the PDF2HASHCAT.PY approved method to obtain the hash from this file. Yet, OCLHASHCAT cannot identify it, not using any of the PDF modes. 

I believe this to be a 40-bit hash, perhaps that's what the *40* means in the hash string.  Windows file properties indicate this is a PDF version 1.4 with 40-bit RC4. I'm using a brute-force attack and because it's presumably 40-bits a mask of 5 bytes (?b?b?b?b?b).

Command> oclhashcat64 -m 10500 -a 3 hashfile.hash ?b?b?b?b?b
oclHashcat v2.01 starting...

WARNING: Hashfile 'hashfile.hash' in line 1 ($pdf$1*3*40 ... ): Line-length exception
Parsed Hashes: 1/1 (100.00%)

ERROR: No hashes loaded

I can't seem to figure this out.  The hash is obtained from the PDF easy enough.  But it doesn't match any of the examples.  What am I missing? 

Here is the hash, with certain portions redacted according to the forum rules.  Thanks for assistance.

$pdf$1*3*40*-4*1*16*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX*32*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX*13*XXXXXXXXXXXXXXXXXXXXXXXXXX