Hashcat is showing wrong password

[qpens8]

Hi,

I'm using hashcat-4.0.1 under windows10.


hashcat64.exe -a 0 -m 10500 ba2.hash rockyou.txt

Same pdf hash different pass 
undefined
undefinedundefined

[qpens8]

my hashcat output

[qpens8]

Is candidate1 showing my pass?
Is hashcat storing my pass somewhere?
Or do I have to do some other operation based on what hashcat is showing on my screen to see recovered pass?

[DanielG]

Is hashcat storing my pass somewhere?

https://hashcat.net/wiki/doku.php?id=fre..._a_potfile

[qpens8]

Is hashcat storing my pass somewhere?

https://hashcat.net/wiki/doku.php?id=fre..._a_potfile

 

From pot file

$pdf$2*3*128*-1852*1*16*f1f4173270397c3d01e852e2ab17f6af*32*c01bac8ecd6da8e0b43b96edbf280bd000000000000000000000000000000000*32*de6f776e3ca732f474d0760e37e4de5881067d2b53c38f476c24cb650fd83e22:

[DanielG]

Maybe the password is blank (my hashcat finds the same empty password for your posted hash). No password on the PDF file, at least not found by the program making the hash?

[qpens8]

I tried empty still not working

[philsmd]

maybe the document can be opened without problem and without password but there are other protections in place like copy/print protection etc.

[qpens8]

maybe the document can be opened without problem and without password but there are other protections in place like copy/print protection etc.

I can see the document I just want to edit it

[undeath]

hashcat can only be used to recover the password of an encrypted pdf document. There are other tools that can remove restrictions from pdf files without cracking the password.