Decoding key M in Pades signature dictionary

Question

I'm working on a Pades signature validation tool in javascript. I have generated a signed pdf file using adobe Acrobat, to use as a test file; i've noticed that the M key in the signature dictionary is not in the form (D:UtcTime) ex: (D:20220524124230Z) but is a sequence of bytes. How do i decode it?

Here is the pdf signature dictionary(couldn't copy the bytes in windows):

Answer 1

Most likely your PDF is encrypted. In an encrypted PDF nearly all strings and streams are encrypted. Dates in PDF are specially formatted strings, so they also are encrypted.

To decode it, analyze the encryption dictionary of the PDF and decrypt the date value.