File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
No antivirus engine detected this long-observed PDF, while one sandbox produced concerning technique mappings that lack malicious-verdict or network-reputation corroboration.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 14y ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 65 antivirus engines that checked it returned no detection, including 18 major antivirus engines, and the file has been observed since 2011. One sandbox mapped credential dumping, process injection, and data destruction techniques, but issued no malicious verdict; the two contacted IP addresses were not reputation-checked.
The strongest evidence is the complete absence of detections across 77 antivirus engines, including 18 major antivirus engines. The PDF has also been known since 2011, which reduces concern that it is an unrecognized newly distributed sample. One completed sandbox run mapped T1003, T1055, and T1485, so those behavioral signals cannot be ignored. However, that run produced no malicious sandbox verdict, and the recorded process activity largely involved Adobe Acrobat components. The nine dropped files had no malicious child result, although their individual verdicts remained unknown. No complete contacted-host reputation result was available.
What We Detected
No detections were returned by 77 antivirus engines, including 18 major antivirus engines. The PDF was first submitted in December 2011 and has appeared in 13 submissions from 10 sources, providing a long observation history.
Threat Behavior
These mappings are concerning, but the sandbox did not issue a malicious verdict, and recorded processes primarily involved Adobe Acrobat, crash-reporting, and updater components. Nine dropped files were inspected without a malicious child finding, though all nine remained unclassified. The run contacted 18.213.11.84 and 92.123.124.167 directly; because contactedHosts is unavailable, no complete reputation conclusion can be drawn for those addresses.
What To Do Now
Open the document only with a fully updated PDF reader and keep security software enabled. If the document arrived unexpectedly or requests unusual interaction, verify its source before opening and consider viewing it in a restricted environment.
Where this verdict could be wrong3 caveats
- The T1003, T1055, and mappings are meaningful counter-signals despite the complete absence of antivirus detections.
- Nine files it created were inspected without a malicious result, but a count of 9 dropped files without a saved verdict means none received a confirmed benign verdict.
- Direct-IP contacts to 18.213.11.84 and 92.123.124.167 cannot be characterized as benign because no contacted-host reputation result was saved.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/65 antivirus engines reported a detection.
- No sandbox returned a malicious verdict.
- No dropped file is known to be malicious.
- The sample has been observed since Dec 4, 2011.
- One sandbox mapped offensive techniques T1003, T1055, and T1485.
- Direct-IP traffic reached 18.213.11.84 and 92.123.124.167 without a completed reputation cross-check.
- All nine inspected files it created have unknown individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 6spawned processes
- 2network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1012
- T1036
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1203
- T1485
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1573
Observed activity
Processes started
6Programs the file ran, with their command lines.
Adobe Crash Processor.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"CRWindowsClientService.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference 182d2756-74e9-4002-9504-06b101fe2ca2 0 0CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\PDF document"Adobe_Updater.exeC:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe -doActionAppID=reader9rdr-es_ES
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
18.213.11.84 - IP address
92.123.124.167
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt - Written
C:\Users\<USER>\AppData\Local\Temp\NGL\NGLClient_AcrobatReader123.8.20533.6.log - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp8CD5.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp94D4.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\A9gklp14_ow7duh_2co.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\A9kkstbn_ow7duj_2co.tmp
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\9.0\UserCache.bin - Written
C:\Users\<USER>\AppData\Local\Adobe\Updater6\AdobeUpdaterPrefs.dat - Written
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll - Written
C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_2 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_3 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents-journal - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\64766d63a539c3ca_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0
Registry and auto-start
3Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cAcrobatUpsellTracking\tTrackingParam - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer\ProductInfoCache - Deleted
HKLM\System\Acrobatviewercpp304
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Global\AdobeCrashProcessorLocalLowLockLocal\ZonesCacheCounterMutexLocal\ZonesLockedCacheCounterMutexLocal\Acrobat Instance MutexLocal\SessionImmersiveColorMutexGlobal\_MSIExecute
Show all 10 entries for mutexes
2AC1A572DB6944B0A65C38C4140AF2F481c74FF310CAcrobat Instance MutexlkwTlhlkBl4nLa+RZHh5Ig==5cc/lvbQhsQNME+6NHD/xg==
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 9bdf729c1be06f906830…9fab46Not checkedno saved verdict
- 610bd324afb0f74bf298…54abb5Not checkedno saved verdict
- 61c2182963cb70e80ec5…c09db8Not checkedno saved verdict
- 2a5ca8e58611ce578c79…c37f4dNot checkedno saved verdict
- fb31c005f753898e7f54…c06c6eNot checkedno saved verdict
- 7a8b7fdb56fef49842d9…019e3dNot checkedno saved verdict
- 621e93b240c5d58e7089…0209e1Not checkedno saved verdict
- 4346319202f1fef1e1ec…5f37d3Not checkedno saved verdict
- 064d9f17752a49aa80c8…671928Not checkedno saved verdict
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 17.3 kB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 9, 2026, 8:55 PM UTC
- SHA-256
05254dd9bed9a81d2c9da60e40bfe77b89e6b757428cc363a802a91ae835e5d5- SHA-1
7620a26cf2ffc6a4d634c7cde816d2f716904d26- MD5
7f5cf7878aa0aa57e1d626f58a4ce49f
First scanned
Antivirus consensus
0 of 65 engines flagged this file
12 of the 77 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust12 engines0flagged
View all 77 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeClean
- McAfeeDNo result
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.