Safe
Unsigned PDF with embedded JavaScript; zero detections across 62 engines including 16 tier-1 vendors; no malicious behaviour observed.
1132a98b88090ca301…3b3f71e445The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file is a newly submitted unsigned PDF with embedded JavaScript. Despite being rare and newly seen, it has achieved near-universal clean status across a comprehensive antivirus network. Sixteen tier-1 engines—representing the most reliable detection capabilities—all report it as undetected or clean. No heuristic rules fired, no external researchers flagged it via YARA or CIRCL, and no malicious hosts were contacted. The generic numeric filename and absence of adversarial patterns further support a benign classification. The combination of high engine coverage, tier-1 consensus, and zero malicious signals strongly indicates this is a legitimate document.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1Malicious=0; 16 tier-1 engines (Avast, BitDefender, Kaspersky, Microsoft, ESET-NOD32, Fortinet, Emsisoft, F-Secure, GData, Ikarus, Avira, AVG, DrWeb) all undetected or clean
engines.reporting=62/74 (83.8% coverage); malicious=0, suspicious=0 — unanimous clean across all reporting engines
prevalence.classification='rare_new' (1 submission, 0 days) — newness alone does not override tier-1 consensus; no signer history needed when coverage is this high
externalIntel: CIRCL.hit=false, YARAify.ruleCount=0, MalwareBazaar.hit=false — no researcher-curated corroboration of malice
triggeredHeuristics=[] (empty); no heuristic rules fired — no synthetic malware indicators
- 16 tier-1 antivirus engines report clean or undetected
- 62/74 engines (83.8% coverage) all report clean
- Zero external-intelligence hits (CIRCL, YARAify, MalwareBazaar)
- No malicious sandbox behaviour
- No malicious dropped children or host contacts
This file is safe. No quarantine or further analysis is needed. The comprehensive clean verdict from our antivirus network confirms it is a legitimate PDF document.
0 detections across 74 engines
How often this file shows up in the wild
Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.
Forensic fingerprint
- File name
- 5_6199308859643796754.pdf
- Size
- 7.75 MB
- MIME type
- application/pdf
- Detected type
- SHA-256
- 1132a98b88090ca30115a97bed643956b172f860b59c45817013333b3f71e445
- MD5
- a0ef0f91a55e2ac93a08ac2261636311
- SHA-1
- 7b2a3f3d417063d208f3e9a7ced8099f9b259f10
- First seen (VT)
- 7/1/2026, 5:40:40 PM
- Last analysis (VT)
- 7/1/2026, 5:40:40 PM
- First scan (MalwareTips)
- 7/1/2026, 5:41:53 PM
- Last scan (MalwareTips)
- 7/1/2026, 5:42:34 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.