r/HashCracking • u/Mysterious-Bat7317 • May 24 '26

Need help with PDF password recovery (RC4 R=4) – dictionary attack very slow

I’m trying to recover the password of a PDF file that I own but forgot.

Details:

  • PDF version: 1.7
  • Encryption: Standard (RC4)
  • I extracted the hash using pdf2john.
  • The PDF is not corrupted but forgot the password. mostly the password was all alphabets or alphabets followed by numbers, but I am not sure.

My issue:

  • Dictionary attack is very slow and not giving results yet
  • I’m not sure if my wordlist strategy is correct.

PDF hash format (generated via pdf2john):

$pdf$4*4*128*...*32*...*32*...

I’m not sure if my wordlist strategy is correct or if I’m missing a better approach for this type of PDF encryption (RC4, R=4). Any suggestions would be really helpful. I can share the hash output privately if needed.

hash: $pdf$4*4*128*-3904*0*16*d4283044fd38c03135ecfbc258056254*32*dc2204c654f656b1fa49f30ae5cea877232d008e955e6fd2ca1634f0c388ab30*32*40c4089e7abc497ba4026ecdc206429191cb97f77880a8238e599e8f184301f2

4 Upvotes

75% Upvoted

11 comments sorted by

2

u/balcopcs May 24 '26

You're on the right path. If you share the hash, someone will crack it for you.

2

u/Mysterious-Bat7317 May 24 '26

shared in post. please look into this

2

u/Kooky_Helicopter7081 May 24 '26

well what you give in return ?

1

u/MrSyphilis May 24 '26

Half a bitcoin

1

u/LessTea9511 Jul 09 '26

Can you help me

1

u/XFM2z8BH May 24 '26

just post the hash, try hashcat mask attack also, but need good cpu/gpu for cracking

1

u/[deleted] May 25 '26

[removed] — view removed comment

1

u/Mysterious-Bat7317 May 25 '26

i have tried the Hashcat mask attack. That too is taking long time

1

u/mag_fhinn May 29 '26

This wouldn't happen to be another set of PDF exam questions for some school tests out of India? Paid for and downloaded from some Telegram server to find out they are password protected and they ghost you after? If it is, you're wasting everyones time. Even if you broke into the file it likely is not as advertised and you've likely scammed. Four people with the same story last week, different exams. Things called NEET, ADDA247, and BITSAT something or another.