Threat LensFile scan report

Is _Raindrop Roofing NW-protected.pdf safe?

62/100

Safety rating

Elevated risk

Verdict

Suspicious

No antivirus engine detected the encrypted PDF, but one sandbox recorded LSASS-related and process-injection telemetry that cannot be confidently attributed to the document.

All 75 antivirus engines returned no detection, including 17 tier-1 engines, and the completed sandbox assigned a clean disposition. However, saved runtime telemetry mapped activity to credential access and process injection, while the encrypted PDF is newly observed, creating an unresolved conflict that merits caution.

Do not open it until verified

Verify the sender and expected document context before opening it, preferably using an isolated environment. Keep endpoint protection enabled and use a fully updated PDF reader.

Read the full analysis

Saved file evidenceAntivirus consensus

0of 75 flagged

Flagged 0No detection 75

Digital specimen_Raindrop Roofing NW-protected.pdf249e65c74e5be40302…e54ffa0b9bfac3

Size98.4 KB

Code signingNot applicable

SandboxRuntime complete

First seenToday

Evidence3 priority signals

1 high-confidence signature or behavior rule matched this file.

Before opening

Do not open it until the source can be verified independently.

If you already opened it

Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from the original trusted source and verify its exact hash when possible.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

Analyst conclusion

Where this verdict could be wrong4 caveats

The absence of detections across 75 engines, including Microsoft, Kaspersky, ESET-NOD32, and BitDefender, weighs strongly against the concerning behavioral mappings.
The sandbox assigned a clean disposition, and the visible process activity is dominated by Adobe Acrobat and standard Windows components.
T1003 and T1055 may reflect activity by the document viewer or sandbox environment rather than code originating from the PDF; the supplied telemetry does not establish attribution.
The encrypted document is newly observed, limiting both static inspection and reputation-based assurance.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Recommended action

Verify the sender and expected document context before opening it, preferably using an isolated environment. Keep endpoint protection enabled and use a fully updated PDF reader.

Scan transparency

Coverage & freshness

3 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
0 of 75 engines flagged the file.
Updated Oct 7, 2026, 5:50 AM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated Oct 7, 2026, 6:29 AM UTC
Network
Not run
No contacted-host reputation check is recorded.
No timestamp recorded
YARA
Complete
2 signature or behavior rules matched.
Updated Oct 7, 2026, 6:29 AM UTC
External intel
Partial
Independent reference checks were attempted but are incomplete.
Updated Oct 7, 2026, 6:29 AM UTC

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime flight recorder

Capture complete

1isolated sandbox run
14MITRE ATT&CK techniques
13spawned processes
0network contacts
24filesystem & mutex artifacts

What this file does

Observed actions and their security significance

High concern: Accessed operating-system credential data, which can expose saved passwords.
High concern: Injected code into another process, a technique that can conceal execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Note: Reads your Windows user-account details.
Note: Collects details about your system.

These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

FileObserved
_Raindrop Roofing NW-protected.pdf
249e65c74e5be40302062f484e500abd7b823fdd93dc8b0070e54ffa0b9bfac3
01Uploaded file

Processes

Runtime execution

ProcessObserved
Observed process
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\_Raindrop Roofing NW-protected.pdf"
02Isolated runtime analysis
ProcessObserved
Observed process
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

Written fileObserved
acroNGLLog.txt
C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt
04Isolated runtime analysis
Written fileObserved
NGL
C:\Users\<USER>\AppData\Local\Temp\NGL\
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

VT: CLEAN·clean

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1003· Credential theftT1012T1027· Obfuscated codeT1033· Reads user infoT1047T1055· Process injectionT1069T1071· Application protocolT1082· System reconT1485T1497· Sandbox evasionT1564· Hides artifactsT1564.003· Hides artifactsT1573

Spawned processes

$(unnamed)

"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\_Raindrop Roofing NW-protected.pdf"

$(unnamed)

"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"

$(unnamed)

C:\Windows\Explorer.EXE

$(unnamed)

"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference 5b2bad2b-2d94-44c8-bbdb-b139f37838b4 0 0

$(unnamed)

C:\Windows\system32\services.exe

$(unnamed)

"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"

$(unnamed)

"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"

$(unnamed)

C:\Windows\System32\svchost.exe -k NetworkService -p

+5 more processes captured.

Persistence

Registry keys set5

HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@%systemroot%\system32\wsdapi.dll,-200
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@C:\Windows\System32\AppxPackaging.dll,-1001
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@%SystemRoot%\System32\SessEnv.dll,-101
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-304
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-305

Filesystem & mutexes

Files written15

C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt
C:\Users\<USER>\AppData\Local\Temp\NGL\
C:\Users\<USER>\AppData\Local\Temp\Tmp8E4.tmp
C:\Users\<USER>\AppData\Local\Temp\TmpA8B.tmp
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

+10 more

Files deleted3

C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings
C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update

Mutexes created6

Global\_MSIExecute
Global\MSILOG_8c1ce6ec1dd565aGOL.e0c11ISM_pmeT_lacoL_ataDppA_onurB_sresU_:C
Global\AdobeCrashProcessorLocalLowLock
\Sessions\1\BaseNamedObjects\{100184D2-BDC3-477a-B8D3-65548B67914C}_6356
\Sessions\1\BaseNamedObjects\Local\{100184D2-BDC3-477a-B8D3-65548B67914C}_900

+1 more

Dropped payload

Files this sample writes at runtime

This file drops 3 children at runtime. None are currently flagged malicious in our cache.

3 unseen

eacad3e01b8b0a44ac03…df796dNever scanned
never seen before
513fb5d3b4195ab59af2…64de2eNever scanned
never seen before
a779a261df447a4c298c…b1b86dNever scanned
never seen before

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

RecordedObserved or authoritative facts

DerivedEvidence-backed analyst inferences

2rule hits recorded
0 / 75engines flagged
1sources in submission history

Evidence provenance

Why these facts are shown

Each statement identifies whether it was directly recorded or derived from saved scan facts.

01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapter
ProvenanceDerived
SourceSignature and behavior rules
Observed atOct 7, 2026, 6:29 AM UTC
02
0 of 75 antivirus engines flagged the file.
View chapter
ProvenanceObserved
SourceAntivirus analysis
Observed atOct 7, 2026, 5:50 AM UTC
03
The hash has been submitted 1 time from 1 source.
View chapter
ProvenanceDerived
SourceSaved report facts
Observed atOct 7, 2026, 6:29 AM UTC
04
Scanned file: _Raindrop Roofing NW-protected.pdf — 249e65c74e5be40302062f484e500abd7b823fdd93dc8b0070e54ffa0b9bfac3
View chapter
ProvenanceObserved
SourceUploaded file
Observed atOct 7, 2026, 6:29 AM UTC
05
Observed process — "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\_Raindrop Roofing NW-protected.pdf"
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atOct 7, 2026, 6:29 AM UTC
06
Observed process — "C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atOct 7, 2026, 6:29 AM UTC
07
File written: acroNGLLog.txt — C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atOct 7, 2026, 6:29 AM UTC
08
File written: NGL — C:\Users\<USER>\AppData\Local\Temp\NGL\
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atOct 7, 2026, 6:29 AM UTC

Evidence map

Detection sources at a glance

1 completed · 3 unavailable

Antivirus

No match

0/75 flagged

Malware samples

Unavailable

unavailable

Researcher rules

Unavailable

unavailable

Reference software

Unavailable

unavailable

Threat attribution

No specific family attributed

The available sources did not agree on a named threat category.

External intelligence

No confirmed researcher-database hit

Available reference checks returned no match, but at least one source was unavailable. This is not a clean result.

Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

2 heuristics

MITRE ATT&CK profile

Defense evasion× 1Cred access× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
high
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence
C:\Windows\Explorer.EXE
CredentialDumper
T1003 T1003.001
medium
Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
Evidence
C:\Windows\system32\lsass.exe

Antivirus consensus

0 of 75 engines flagged this file

0 malicious0 suspicious75 not flagged

Tier-117 engines

0flagged

Tier-241 engines

0flagged

Low-trust17 engines

0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisOK

AhnLab-V3OK

Alibabatyp

alibabacloudOK

ALYacOK

Antiy-AVLOK

APEXtyp

ArcabitOK

AvastOK

Avast-Mobiletyp

AVGOK

AviraOK

BitDefenderOK

BitDefenderFalxtyp

BkavOK

CAT-QuickHealOK

ClamAVOK

CMCOK

CrowdStrikeOK

CTXOK

CylanceOK

CynetOK

DeepInstincttyp

DrWebOK

Elastictyp

EmsisoftOK

ESET-NOD32OK

F-SecureOK

FortinetOK

GDataOK

GoogleOK

GridinsoftOK

huorongOK

IkarusOK

JiangminOK

K7AntiVirusOK

K7GWOK

KasperskyOK

KingsoftOK

LionicOK

MalwarebytesOK

MaxSecureOK

McAfeeDOK

MicrosoftOK

MicroWorld-eScanOK

NANO-AntivirusOK

Paloaltotyp

PandaOK

RisingOK

SangforOK

SentinelOneOK

SkyhighOK

SophosOK

SUPERAntiSpywareOK

SymantecOK

SymantecMobileInsighttyp

TACHYONOK

tehtristyp

TencentOK

Trapminetyp

TrellixENSOK

TrendMicroOK

TrendMicro-HouseCallOK

Trustlooktyp

VaristOK

VBA32OK

VIPREOK

VirITOK

ViRobotOK

Webroottyp

XcitiumOK

YandexOK

ZillyaOK

ZoneAlarmOK

ZonerOK

PE structure

Not applicable

PE structure analysis applies to Windows executable formats, not this file type.

Prevalence

How widely this file has been seen

Barely seen in the wild and first surfaced recently. That limits reputation evidence, but rarity alone is not proof of malware.

Rare & new

Unique uploaders

Very few people have ever uploaded this — rare.

Total submissions

Includes repeat uploads by the same source.

First seen

0d ago

Oct 7, 2026

Prevalence quadrant

here

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: _Raindrop Roofing NW-protected.pdf
Format: PDF
Code signing: Not applicable to this file type
Size: 98.4 KB
Last analyzed: Oct 7, 2026, 6:29 AM UTC

SHA-256

249e65c74e5be40302062f484e500abd7b823fdd93dc8b0070e54ffa0b9bfac3

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

We couldn't fully clear this file. Treat it with caution.

Recovery step 01
Don't open it unless you're certain it came from a source you trust.
Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
Recovery step 03
If its origin cannot be confirmed, delete this file and use a fresh copy from a trusted source. Get a fresh copy from the original trusted source and verify its exact hash when possible.
Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.

Safety FAQ

Direct answers grounded in the saved verdict and evidence in this report.

7 evidence-based answers

Is _Raindrop Roofing NW-protected.pdf safe, or is it malware?

Evidence-based answer

_Raindrop Roofing NW-protected.pdf is suspicious — treat it as unsafe until you're sure. No antivirus engine flagged it; the cautious verdict comes from other saved evidence such as identity, prevalence, signing, or runtime signals. Don't open it unless you fully trust where it came from. Get a fresh copy from the original trusted source and verify its exact hash when possible.

What is _Raindrop Roofing NW-protected.pdf?

Evidence-based answer

_Raindrop Roofing NW-protected.pdf is a document file, about 98 KB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.

How many antivirus engines detected _Raindrop Roofing NW-protected.pdf?

Evidence-based answer

None — 0 of 75 antivirus engines flagged _Raindrop Roofing NW-protected.pdf. A clean antivirus result is not proof of safety; the cautious verdict comes from other saved evidence such as identity, prevalence, signing, or runtime signals.

I already downloaded and opened _Raindrop Roofing NW-protected.pdf — what should I do?

Evidence-based answer

Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.

How do I remove _Raindrop Roofing NW-protected.pdf?

Evidence-based answer

To remove _Raindrop Roofing NW-protected.pdf: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete this file from the device, then empty the Recycle Bin or Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.

What is the SHA-256 hash of _Raindrop Roofing NW-protected.pdf?

Evidence-based answer

The SHA-256 hash of _Raindrop Roofing NW-protected.pdf is 249e65c74e5be40302062f484e500abd7b823fdd93dc8b0070e54ffa0b9bfac3, and its MD5 is f129958887d858935fc12f041d1792bd. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

How up to date is this analysis of _Raindrop Roofing NW-protected.pdf?

Evidence-based answer

This report reflects the scan run on October 7, 2026. Because a file's hash never changes, the identity of _Raindrop Roofing NW-protected.pdf is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is _Raindrop Roofing NW-protected.pdf safe?

No antivirus engine detected the encrypted PDF, but one sandbox recorded LSASS-related and process-injection telemetry that cannot be confidently attributed to the document.

Recommended next actions

Before opening

If you already opened it

What We Detected

Threat Behavior

What To Do Now

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Runtime flight recorder

What this file does

Attack story

_Raindrop Roofing NW-protected.pdf

Observed process

Observed process

acroNGLLog.txt

NGL

Why these facts are shown

Detection sources at a glance

PE structure

Fingerprint and provenance

What to do now