hashcat Forum
PDF different HASH outputs - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: PDF different HASH outputs (/thread-7348.html)



PDF different HASH outputs - andydis - 03-07-2018

So I have a PDF file ,  extract the hash using JOHN2PDF.PY

and get the follwoing output:-

$pdf$1*2**4294963412*1*16*1fb2832cb7bb5a0e00cdf68425c3891a*28*866f90a6539e6dbaa9a1dc8bfeb729f047fed059e1430e993a9d3528*32*866f90a6539e6dbaa9a1dc8bfeb729f047fed059e1430e993a9d352829c440b6

But then use another JOHN2PDF.PL and get a different output 

$pdf$1*2*40*4294963412*1*16*1fb2832cb7bb5a0e00cdf68425c3891a*32*17631e7cf4af9f9e87e3dee76d0b24f6d6ee9fef6e6ecd71cca2a4ec02ed74bb*14*866f90a6539e6dbaa9a1dc8bfeb7

So i tried the online extracter at http://www.hash-c.co.uk and get the above too.


Both hashes will not work with lastest version of hashcat on mode 10400 , 10500 or 10600 ?

I get line length or salt length errors.

Any idea's?


RE: PDF different HASH outputs - tacohashcat - 03-08-2018

compare them to the example hashes, there is also a pdf2hashcat python script available. You could try using that. Looking at the examples, the second hash looks closest to mode 10400. 

Also, you're not supposed to be posting hashes unless they are a known hash used for an example.