File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
No antivirus engine detected this long-observed PDF, while one sandbox produced concerning technique mappings that lack malicious-verdict or network-reputation corroboration.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 14y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 65 antivirus engines that checked it returned no detection, including 18 major antivirus engines, and the file has been observed since 2011. One sandbox mapped credential dumping, process injection, and data destruction techniques, but issued no malicious verdict; the two contacted IP addresses were not reputation-checked.
The strongest evidence is the complete absence of detections across 77 antivirus engines, including 18 major antivirus engines. The PDF has also been known since 2011, which reduces concern that it is an unrecognized newly distributed sample. One completed sandbox run mapped T1003, T1055, and T1485, so those behavioral signals cannot be ignored. However, that run produced no malicious sandbox verdict, and the recorded process activity largely involved Adobe Acrobat components. The nine dropped files had no malicious child result, although their individual verdicts remained unknown. No complete contacted-host reputation result was available.
What We Detected
No detections were returned by 77 antivirus engines, including 18 major antivirus engines. The PDF was first submitted in December 2011 and has appeared in 13 submissions from 10 sources, providing a long observation history.
Threat Behavior
These mappings are concerning, but the sandbox did not issue a malicious verdict, and recorded processes primarily involved Adobe Acrobat, crash-reporting, and updater components. Nine dropped files were inspected without a malicious child finding, though all nine remained unclassified. The run contacted 18.213.11.84 and 92.123.124.167 directly; because contactedHosts is unavailable, no complete reputation conclusion can be drawn for those addresses.
What To Do Now
Open the document only with a fully updated PDF reader and keep security software enabled. If the document arrived unexpectedly or requests unusual interaction, verify its source before opening and consider viewing it in a restricted environment.
Where this verdict could be wrong3 caveats
- The T1003, T1055, and mappings are meaningful counter-signals despite the complete absence of antivirus detections.
- Nine files it created were inspected without a malicious result, but a count of 9 dropped files without a saved verdict means none received a confirmed benign verdict.
- Direct-IP contacts to 18.213.11.84 and 92.123.124.167 cannot be characterized as benign because no contacted-host reputation result was saved.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/65 antivirus engines reported a detection.
- No sandbox returned a malicious verdict.
- No dropped file is known to be malicious.
- The sample has been observed since Dec 4, 2011.
- One sandbox mapped offensive techniques T1003, T1055, and T1485.
- Direct-IP traffic reached 18.213.11.84 and 92.123.124.167 without a completed reputation cross-check.
- All nine inspected files it created have unknown individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 6spawned processes
- 2network contacts
- 40filesystem & mutex artifacts
Includes 12 mapped techniques, every process, file, registry and network entry and 9 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 17.3 kB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 9, 2026, 8:55 PM UTC
- SHA-256
05254dd9bed9a81d2c9da60e40bfe77b89e6b757428cc363a802a91ae835e5d5- SHA-1
7620a26cf2ffc6a4d634c7cde816d2f716904d26- MD5
7f5cf7878aa0aa57e1d626f58a4ce49f
First scanned
Includes every engine result (77), 2 matched signature rules and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.