Weird Issue Cracking 128-bit RC4 Acrobat 6.0 PDF from Acrobat 10.0 Paper Capture Plug

[Xtraeme]

You are quick philsmd. I'm writing up a ticket now (ticket 594). For easier tracking I'm including the PDF encryption object. Both of the PDFs are backwards compatible to Acrobat 6.0. I obscured parts of the hash and substituted in # signs.

The problem file PDF-password-is-...pdf:

Code:

obj 1126 0 Type: Referencing: << /CF << /StdCF << /AuthEvent /DocOpen /CFM /V2 /Length 16 >> >> /Filter /Standard /Length 128 /O '(\x##\x##P}\xab\xd1\x8b\xe0\xaa\\r\x9fLp`|\x0f\xa1\x83\xba\x9c\xf5\xe5\x03\x02jRC\x19\xb5\x##u\x##)' /P -1324 /R 4 /StmF /StdCF /StrF /StdCF /U '(\x##\x##Vj\x10\xeb\xa7\tw\xb1\xb2O#\xd0\x##\x##\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x##\x##)' /V 4 >>

The file that worked PDF-password-is-hashcat.pdf:

Code:

obj 73 0 Type: Referencing: << /CF << /StdCF << /AuthEvent /DocOpen /CFM /V2 /Length 16 >> >> /EncryptMetadata false /Filter /Standard /Length 128 /O '(\x##t\x##0\t\xb8b\x8d\xba\x9e3\xc6\xcf\xf4\x98F\xff\xcb\x8eV \xe5\x81\xda\xd6\xce.#\xe0\x##R\x##)' /P -1324 /R 4 /StmF /StdCF /StrF /StdCF /U '(\x##S\x##\xf3\x10\xb8\xc9\x1f\x8d\xee\xc0=,\x##S\x##\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x##\x##)' /V 4 >>