PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1 Hash

Technical details, regex signatures, and cracking commands for the PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1 algorithm.

Regex Identification Signature:

                        \$pdf\$1\*[2|3]\*[0-9]{2}\*[-0-9]{1,6}\*[0-9]\*[0-9]{2}\*[a-f0-9]{32,32}\*[0-9]{2}\*[a-f0-9]{64}\*[0-9]{2}\*[a-f0-9]{64}
                    

Hashcat Command (Mode: 10410):

John the Ripper Command:

← Back to Hash Identifier

What is PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1?

The cryptographic hash format referred to as "PDF 1.1–1.3 (Acrobat 2–4), collider #1" originates from Adobe’s early PDF encryption schemes, specifically those implemented in Acrobat versions 2 through 4 (PDF 1.1–1.3). This format leverages a proprietary hybrid cryptographic construction combining a **40-bit RC4 stream cipher** for key derivation and a **SHA-1-based hash** (or its predecessor, MD5 in some cases) to secure document metadata and permissions. The structure involves a two-stage process: first, a user password is hashed (with no salt) to generate a 16-byte key via a simple iteration of XOR and bitwise operations, then this key is used to derive an RC4 keystream for encrypting the PDF’s file trailer and trailer dictionary. The primary use-case was lightweight document authentication and access control, though it was never designed for high-security applications—its purpose was to deter casual tampering rather than resist professional cryptanalysis.

The vulnerability of this scheme stems from fundamental cryptographic flaws exacerbated by implementation weaknesses. The absence of a **salt** or **pepper** in the key derivation process renders it susceptible to **rainbow table attacks**, as the same password always produces the same hash. Additionally, the **40-bit key space** is trivial to brute-force using modern GPU-accelerated tools (e.g., Hashcat or John the Ripper), with attacks achieving **sub-second cracking** for weak passwords. The reliance on **SHA-1 (or MD5)** for integrity checks also introduces collision risks, though the primary weakness lies in the **predictable key derivation** and **RC4’s known weaknesses** when used with short keys. Optimizations like **parallelized GPU cracking** and **precomputed tables** further accelerate exploitation, rendering this format effectively broken for any security-critical application.

Identifying PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1 Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1, security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1

If you need to recover the plaintext password for a PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1 hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.