Unsupported PDF hash

[viperxp]

Hello.

I've got a pdf I received from my employer that I actually have a password for, that is in strange status.

If I generate a hash using John - John can crack it.
If I take the hash to hashcat - it can't crack it, and in fact it does not look exactly like any of the supported hashes.

the hash starts with "$pdf$2*3*128*4294967292*1*16*" 

This is the error I am getting when trying to crack it 

"Hashfile 'd:\hash' on line 1 ($pdf$2...XXX): Token length exception

* Token length exception: 1/1 hashes
  This error happens if the wrong hash type is specified, if the hashes are
  malformed, or if input is otherwise not as expected (for example, if the
  --username option is used but no username is present)

No hashes loaded."

** If I replace the " 4294967292" with "-1028" so it looks like a valid hash, hashcat actually starts cracking it but can't crack it (I know for a fact that the password is a part of the wordlist). I use "10500" mode , the process just ends without result. I tried other "pdf" related modes - no success.

** Of course I remove the pdf filename from beginning of the hash

 -1028"

[lapsikmees]

Hi,

what gpu you have?

[viperxp]

Hi,

what gpu you have?

3070ti laptop . Unsure if it's related.

Ah, and using the latest hashcat (6.2.6)

[lapsikmees]

Intel ones seems to have a problem with these.

You can try hashcat beta or build latest from github.

[viperxp]

Intel ones seems to have a problem with these.

You can try hashcat beta or build latest from github.

I don't think it's related to the GPU/CPU. The format is the issue....

[lapsikmees]

Whats your full command without hash?

[viperxp]

Whats your full command without hash?

hashcat.exe -m 10500 -d 2 d:\01\hash2 -a 0 d:\01\list.txt 

or the similar on linux

the result is exactly the same ..

[nick8606]

** If I replace the " 4294967292" with "-1028" so it looks like a valid hash, hashcat actually starts cracking it but can't crack it

Signed value of 4294967292 is -4 (not -1028).

P. S. The same problem was recently discussed here.

[viperxp]

** If I replace the " 4294967292" with "-1028" so it looks like a valid hash, hashcat actually starts cracking it but can't crack it

Signed value of 4294967292 is -4 (not -1028).

P. S. The same problem was recently discussed here.

Thanks, changed the " 4294967292" to "-4" and successfully cracked the file