Weird Issue Cracking 128-bit RC4 Acrobat 6.0 PDF from Acrobat 10.0 Paper Capture Plug

[Xtraeme]

You are quick philsmd. I'm writing up a ticket now (ticket 594). For easier tracking I'm including the PDF encryption object. Both of the PDFs are backwards compatible to Acrobat 6.0. I obscured parts of the hash and substituted in # signs.

The problem file PDF-password-is-...pdf:

Code:

obj 1126 0
Type:
Referencing:

  <<
    /CF
      <<
        /StdCF
          <<
            /AuthEvent /DocOpen
            /CFM /V2
            /Length 16
          >>
      >>
    /Filter /Standard
    /Length 128
    /O '(\x##\x##P}\xab\xd1\x8b\xe0\xaa\\r\x9fLp`|\x0f\xa1\x83\xba\x9c\xf5\xe5\x03\x02jRC\x19\xb5\x##u\x##)'
    /P -1324
    /R 4
    /StmF /StdCF
    /StrF /StdCF
    /U '(\x##\x##Vj\x10\xeb\xa7\tw\xb1\xb2O#\xd0\x##\x##\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x##\x##)'
    /V 4
  >>

The file that worked PDF-password-is-hashcat.pdf:

Code:

obj 73 0
Type:
Referencing:

<<
    /CF
      <<
        /StdCF
          <<
            /AuthEvent /DocOpen
            /CFM /V2
            /Length 16
          >>
      >>
    /EncryptMetadata false
    /Filter /Standard
    /Length 128
    /O '(\x##t\x##0\t\xb8b\x8d\xba\x9e3\xc6\xcf\xf4\x98F\xff\xcb\x8eV \xe5\x81\xda\xd6\xce.#\xe0\x##R\x##)'
    /P -1324
    /R 4
    /StmF /StdCF
    /StrF /StdCF
    /U '(\x##S\x##\xf3\x10\xb8\xc9\x1f\x8d\xee\xc0=,\x##S\x##\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x##\x##)'
    /V 4
  >>