PDF different HASH outputs

[andydis]

So I have a PDF file ,  extract the hash using JOHN2PDF.PY

and get the follwoing output:-

$pdf$1*2**4294963412*1*16*1fb2832cb7bb5a0e00cdf68425c3891a*28*866f90a6539e6dbaa9a1dc8bfeb729f047fed059e1430e993a9d3528*32*866f90a6539e6dbaa9a1dc8bfeb729f047fed059e1430e993a9d352829c440b6

But then use another JOHN2PDF.PL and get a different output 

$pdf$1*2*40*4294963412*1*16*1fb2832cb7bb5a0e00cdf68425c3891a*32*17631e7cf4af9f9e87e3dee76d0b24f6d6ee9fef6e6ecd71cca2a4ec02ed74bb*14*866f90a6539e6dbaa9a1dc8bfeb7

So i tried the online extracter at www.hash-c.co.uk and get the above too.


Both hashes will not work with lastest version of hashcat on mode 10400 , 10500 or 10600 ?

I get line length or salt length errors.

Any idea's?

[tacohashcat]

compare them to the example hashes, there is also a pdf2hashcat python script available. You could try using that. Looking at the examples, the second hash looks closest to mode 10400. 

Also, you're not supposed to be posting hashes unless they are a known hash used for an example.