File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
No antivirus engine detected malware in this long-established PDF, while unresolved direct-IP contacts warrant ordinary caution when opening documents.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 15
- Code signing Not applicable
- Test run Completed
- First seen 13y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The PDF received no detections from 76 antivirus engines, including no major flags, and has been observed repeatedly for more than 13 years. Two direct-IP contacts lack a completed reputation check, but there is no corroborating malware family, offensive technique, malicious child, or researcher-intelligence hit.
No engine among 76 detected malware or suspicious content, and all 18 reporting major antivirus engines were silent. The PDF has a long history and 101 submissions from 75 sources, reducing concern that it is a newly introduced sample. No completed observation from the test run is available because the sandbox count is zero, so the activity cannot be characterized as normal or harmful. A rule noted two direct-IP contacts, but their reputation was not checked and no independent evidence identifies them as malicious. External intelligence produced no YARAify, CIRCL, or MalwareBazaar hit, while none of the eight inspected child hashes was confirmed malicious.
What We Detected
The PDF produced 0 detections across 76 antivirus engines, with the absence of major detections and 18 major antivirus engines reporting no detection. It has been known for 5,018 days and has appeared in 101 submissions from 75 sources.
Threat Behavior
No completed sandbox run is available because no sandbox run was recorded, and no high-risk MITRE technique was recorded. One of our behaviour rules noted contacts to 54.144.73.197 and 2.18.233.74, but the missing contacted-host reputation result means no complete reputation assessment exists for those addresses. Eight child hashes were inspected without a confirmed malicious child, although all eight remain unclassified.
What To Do Now
Open the document only with an updated PDF reader and keep security software enabled. If the source is unexpected or the document requests scripts, embedded files, credentials, or unusual permissions, close it and verify the source independently.
Where this verdict could be wrong3 caveats
- One of our behaviour rules fired after contacts to 54.144.73.197 and 2.18.233.74; the missing contacted-host reputation result means no complete host-reputation result is available.
- The absence of a sandbox run means the listed activity was not backed by a completed sandbox verdict.
- All 8 inspected files it created have unknown verdicts, so the absence of a known-malicious dropped file does not establish that those children are benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/61 antivirus engines detected malware or suspicious content.
- No major antivirus engines flagged it and 18 major antivirus engines reported it clean.
- The file has 5,018 days of history and 101 submissions from 75 sources.
- No high-risk MITRE techniques were recorded.
- YARAify, CIRCL, and MalwareBazaar returned no hit.
- One of our behaviour rules recorded two direct-IP contacts without a completed host-reputation check.
- No completed sandbox observation is available.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 2sandbox rule tags
- 0spawned processes
- 2network contacts
- 38filesystem & mutex artifacts
Includes 2 mapped techniques, every process, file, registry and network entry and 8 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 3.8 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 9, 2026, 1:22 AM UTC
- SHA-256
09d71f72635756bef15a38041bc7608419a535c4e5c742a0fe8e25674193c22d- SHA-1
581136a98e2d6888e9bc91c64d737942e1f7dd9c- MD5
139d2eb8190163bfb53d878efc7ae554
First scanned
Includes every engine result (76) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.