12-03-2018, 08:02 PM
(12-03-2018, 02:17 PM)philsmd Wrote: I think it should be -m 10400 = PDF 1.1 - 1.3 (Acrobat 2 - 4)
but your hash starts with $pdf$1*3* and only V == 1 and R == 2 is allowd by the parser.
Remember that you should never post hashes on this forum... and only if you are asked by an admin/moderator, you of course need to include the password too (otherwise it's diffucult to troubleshoot anything).
Can you confirm it is a Acrobat 2, Acrobat 3 or Acrobat 4 PDF format ? I think the problem is that hashcat just doesn't allow R = 3
Yep you're right, it's PDF v1.4, I was confused with standard v1.3 (encryption). Although I had already tested with -m 10500 (PDF 1.4 - 1.6, Acrobat 5 - 8), which returns "Token length exception".