File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
No antivirus engine detected malware in this long-established PDF, while unresolved direct-IP contacts warrant ordinary caution when opening documents.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 15
- Code signing Not applicable
- Test run Completed
- First seen 13y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The PDF received no detections from 76 antivirus engines, including no major flags, and has been observed repeatedly for more than 13 years. Two direct-IP contacts lack a completed reputation check, but there is no corroborating malware family, offensive technique, malicious child, or researcher-intelligence hit.
No engine among 76 detected malware or suspicious content, and all 18 reporting major antivirus engines were silent. The PDF has a long history and 101 submissions from 75 sources, reducing concern that it is a newly introduced sample. No completed observation from the test run is available because the sandbox count is zero, so the activity cannot be characterized as normal or harmful. A rule noted two direct-IP contacts, but their reputation was not checked and no independent evidence identifies them as malicious. External intelligence produced no YARAify, CIRCL, or MalwareBazaar hit, while none of the eight inspected child hashes was confirmed malicious.
What We Detected
The PDF produced 0 detections across 76 antivirus engines, with the absence of major detections and 18 major antivirus engines reporting no detection. It has been known for 5,018 days and has appeared in 101 submissions from 75 sources.
Threat Behavior
No completed sandbox run is available because no sandbox run was recorded, and no high-risk MITRE technique was recorded. One of our behaviour rules noted contacts to 54.144.73.197 and 2.18.233.74, but the missing contacted-host reputation result means no complete reputation assessment exists for those addresses. Eight child hashes were inspected without a confirmed malicious child, although all eight remain unclassified.
What To Do Now
Open the document only with an updated PDF reader and keep security software enabled. If the source is unexpected or the document requests scripts, embedded files, credentials, or unusual permissions, close it and verify the source independently.
Where this verdict could be wrong3 caveats
- One of our behaviour rules fired after contacts to 54.144.73.197 and 2.18.233.74; the missing contacted-host reputation result means no complete host-reputation result is available.
- The absence of a sandbox run means the listed activity was not backed by a completed sandbox verdict.
- All 8 inspected files it created have unknown verdicts, so the absence of a known-malicious dropped file does not establish that those children are benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/61 antivirus engines detected malware or suspicious content.
- No major antivirus engines flagged it and 18 major antivirus engines reported it clean.
- The file has 5,018 days of history and 101 submissions from 75 sources.
- No high-risk MITRE techniques were recorded.
- YARAify, CIRCL, and MalwareBazaar returned no hit.
- One of our behaviour rules recorded two direct-IP contacts without a completed host-reputation check.
- No completed sandbox observation is available.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 2sandbox rule tags
- 0spawned processes
- 2network contacts
- 38filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
2MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1036
- T1082· System recon
Observed activity
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
54.144.73.197 - IP address
2.18.233.74
Files
30Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\LocalLow - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_2 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_3
Show all 30 entries for files
- Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\index - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents-journal - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Deleted
HKLM\System\Acrobatviewercpp304
Mutexes
8Named locks a program uses so only one copy runs; malware families often reuse them.
2AC1A572DB6944B0A65C38C4140AF2F44cc7130310CAcrobat Instance Mutex\Sessions\1\BaseNamedObjects\{100184D2-BDC3-477a-B8D3-65548B67914C}_7068\Sessions\1\BaseNamedObjects\Local\{100184D2-BDC3-477a-B8D3-65548B67914C}_3160\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex\Sessions\1\BaseNamedObjects\Global\{100184D2-BDC3-477a-B8D3-65548B67914C}_3224
Show all 8 entries for mutexes
\Sessions\1\BaseNamedObjects\com.adobe.acrobat.rna.RdrCefBrowserLock.DC\Sessions\1\BaseNamedObjects\DBWinMutex
Files this sample writes at runtime
This file drops 8 children at runtime. None are currently flagged malicious in our cache. 8 have no saved verdict and were not checked; that is missing coverage, not a finding.
- a418bffeb6e9539701f6…4f32e8Not checkedno saved verdict
- 159a51cef4822afe893c…750c98Not checkedno saved verdict
- 726bcbb5f825feee1e63…506e66Not checkedno saved verdict
- 8d6aaffcdddc8cb7069c…f5ebf5Not checkedno saved verdict
- 2477b4aa138e2f36e348…140236Not checkedno saved verdict
- 7c2d9a250fc94fc5958c…ac0784Not checkedno saved verdict
- 5630f3305dbc0f9a6700…4969d0Not checkedno saved verdict
- a4bfcfbabe76188f0942…ee4ffbNot checkedno saved verdict
Chapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 3.8 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 9, 2026, 1:22 AM UTC
- SHA-256
09d71f72635756bef15a38041bc7608419a535c4e5c742a0fe8e25674193c22d- SHA-1
581136a98e2d6888e9bc91c64d737942e1f7dd9c- MD5
139d2eb8190163bfb53d878efc7ae554
First scanned
Antivirus consensus
0 of 61 engines flagged this file
15 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust10 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BitDefenderThetaClean
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeNo result
- CybereasonNo result
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MAXClean
- MaxSecureClean
- McAfeeClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.