Hash every word in a wordlist and match it against a PDF password hash, the same idea John the Ripper uses.
$pdf$