File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
This PDF document shows no antivirus detections across 74 engines, and sandbox runs saw only Adobe Acrobat opening it and contacting Adobe's own services.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This PDF document can be opened normally. Keep your PDF reader updated and your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 13
- Code signing Not applicable
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 61 antivirus engines that checked it flagged this PDF document, and it has been circulating since 2022 without detections. Sandbox runs show Acrobat opening it normally, with network traffic only to Adobe hosts. It contains embedded JavaScript and an automatic action, which interactive manuals often use.
No engine, including 18 major antivirus engines, detected the file. Three sandbox runs recorded only Adobe Acrobat and its own crash and logging helpers, with no injection into other processes. The network contacts were Adobe services, and none of the inspected hosts are known to be malicious or suspicious. Sandbox labels for injection and credential access appeared without any matching activity and carry no weight. The embedded JavaScript and auto-action tags are worth noting, but there is no hostile evidence beside them.
What We Detected
None of the 61 antivirus engines that checked it flagged this PDF document. It was first seen on Aug 8, 2022, and no public malware database or community rule lists it.
Threat Behavior
When opened in a sandbox, only Adobe Acrobat and its own helper processes ran. Network traffic went to Adobe services, and none of the contacted hosts are known to be malicious. The document contains embedded JavaScript and an automatic open action, which is common in interactive documents, and nothing indicates it launches programs or downloads code.
What To Do Now
The document appears safe to open. As usual, keep your PDF reader up to date and get manuals from the manufacturer or a trusted source.
Where this verdict could be wrong1 caveat
- The PDF carries embedded JavaScript and an automatic action; these are common in interactive manuals, but our own static analysis did not examine the bytes, so their content was not reviewed.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 61 antivirus engines that checked it flagged the file, including all major antivirus engines.
- Sandbox runs showed only Adobe Acrobat opening the document, with no activity against other processes.
- Network contacts were limited to Adobe services, and no contacted host is known to be malicious.
- The file has circulated since 2022 without any detections or malware database listings.
- The document contains embedded JavaScript and an automatic action, although no harmful use of them was observed.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 17sandbox rule tags
- 5spawned processes
- 8network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
17MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1014
- T1036
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1189
- T1203
- T1485
- T1496
- T1542
- T1542.003
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
- T1573
Observed activity
Processes started
5Programs the file ran, with their command lines.
Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\PDF document"Adobe Crash Processor.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"CRWindowsClientService.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference 4beeb43c-58cf-4adf-8405-e332f0ad90c3 0 0CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"
Network contacts
88 hosts, listed as 4 domains, 4 addresses. Links show the host and path only.
- Domain
geo2.adobe.com - Domain
p13n.adobe.io - Domain
armmf.adobe.com - Domain
acroipm2.adobe.com - IP address
96.7.156.186 - IP address
23.197.100.189
Show all 8 entries for network contacts
- IP address
50.16.47.176 - IP address
92.123.124.167
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt - Written
C:\Users\<USER>\AppData\Local\Temp\NGL\NGLClient_AcrobatReader123.8.20533.6.log - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp268E.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp2D84.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\A99tjfao_127emn7_484.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\A9ndwogs_127emn8_484.tmp
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\A9jjad8y_127emnb_484.tmp - Written
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3812 - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3812 - Written
C:\Program Files (x86)\Common Files - Written
C:\Program Files (x86)\Common Files\Adobe\Linguistics\10.0\LanguageNames2 - Written
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2 - Written
C:\Users\user\AppData\LocalLow - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0
Registry and auto-start
18Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config\LastKnownGoodTime - Set
Software\Adobe\Acrobat Reader\DC\ExitSection\bLastExitNormal - Set
HKEY_LOCAL_MACHINE\System\Acrobatbrokerserverdispatchercpp789 - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral\cUUIDs - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\ToolsSearch - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent\cWin0
Show all 18 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent\cWin0\cTab0 - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement\cWindowsCurrent\cWin0\cTab0\cPathInfo - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral\cRecentFiles - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral\cRecentFiles\c1 - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral\cRecentFiles\c2 - Set
HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer\DC\WebServers - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cDocumentCenter\cSettings - Set
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\Collab\cEmailDistribution - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer\ProductInfoCache - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cAcrobatUpsellTracking\tTrackingParam - Deleted
HKEY_LOCAL_MACHINE\System\Acrobatviewercpp473
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Acrobat Instance MutexGlobal\_MSIExecuteGlobal\MSILOG_c95c9cf71db8d5dGOL.34531ISM_pmeT_lacoL_ataDppA_onurB_sresU_:CGlobal\AdobeCrashProcessorLocalLowLockLocal\ZonesCacheCounterMutexLocal\ZonesLockedCacheCounterMutex
Show all 10 entries for mutexes
\Sessions\1\BaseNamedObjects\{100184D2-BDC3-477a-B8D3-65548B67914C}_3084\Sessions\1\BaseNamedObjects\Local\{100184D2-BDC3-477a-B8D3-65548B67914C}_3864\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex\Sessions\1\BaseNamedObjects\Global\{100184D2-BDC3-477a-B8D3-65548B67914C}_3864
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 7 entries for sandbox background — not the file
- VM host
dns.google
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- cdbb18890705fdb67074…83f048Not checkedno saved verdict
- a064faef878c9f01e625…0d7c09Not checkedno saved verdict
- 4306d2926d0cf7435453…b0ce89Not checkedno saved verdict
- 792eade5589d57e8cbc7…b0fdabNot checkedno saved verdict
- 417e532b51c4f08637b6…19560eNot checkedno saved verdict
- 8ae9a47f13b2d3d3b619…ce416bNot checkedno saved verdict
- 3ac2931408b5defcedfe…9573b2Not checkedno saved verdict
- dd0dedc7d2fa4482f099…aa657dNot checkedno saved verdict
- 311a9ce31197b420c827…3e5f85Not checkedno saved verdict
- 3881957df76507226f4b…24ffefNot checkedno saved verdict
Chapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 28.4 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Oct 22, 2026, 12:20 AM UTC
- SHA-256
149a47bdb5d141c341aad51397b87961f48d0c9392fb50cc100485569d23a916- SHA-1
621b6693c7add86aaa9c252737a7d13babc2e29c- MD5
6b2a90ab5490a9cdac48cc1893bc6e84
First scanned
Antivirus consensus
0 of 61 engines flagged this file
13 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-232 engines0flagged
- Low-trust11 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.