MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Suspicious

Clean engine results clash with sandbox evidence of process injection and LSASS access.

Trust score45Caution
ipc-whma-a-620b-spdf_compress.pdf
569.4 KB
2b1a1799462da96ede…d1828642df
Antivirus engines
0 of 75 flagged
Code signing
Unsigned
Age
First seen 8y ago
MT AI Engine · Verdict analysis

The reasoning behind this verdict

The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.

65%Confidence
High
Reasoning

Zero detections across 61 reporting engines including 16 tier-1 clean reports is a strong safe signal. However, the sandbox recorded three offensive MITRE techniques (T1003, T1055, T1485) plus explicit LSASS access and CreateRemoteThread activity. These behaviours are inconsistent with normal PDF handling and triggered two high-severity heuristics. The combination of clean engine consensus and malicious behavioural indicators places the sample in mixed-signals territory.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines: 0 malicious detections out of 75 total (16 tier-1 clean)

  2. behaviour.offensiveTechniques: T1003, T1055, T1485 observed in sandbox

  3. triggeredHeuristics: MalwareTips.Synth.ProcessInjection and MalwareTips.Synth.CredentialDumper both fired

  4. prevalence.classification: rare_old with only 3 submitters over 2940 days

Points in its favour
  • Zero malicious detections across 75 engines
  • 16 tier-1 engines reported clean
  • No malicious dropped children or contacted hosts
Points against
  • Sandbox observed process injection (T1055) and LSASS access (T1003)
  • Rare_old prevalence with only three historical submitters
  • Unsigned PDF with no established signer history
Recommended action

Treat as suspicious pending further dynamic analysis; do not execute or distribute the file.

What this file does

What it attempted when executed in an isolated sandbox

  • High concern: Tries to steal saved passwords and credentials from Windows.

  • High concern: Hides inside another running program to evade antivirus.

  • High concern: Talks to a remote server to take commands or send out your data.

  • Moderate concern: Checks whether it's being watched in a sandbox before acting.

  • Note: Reads your Windows user-account details.

  • Note: Collects details about your system.

Translated from the file's technical behaviour during analysis. It never ran on your device.

What to do now

We couldn't fully clear this file. Treat it with caution.

  1. Don't run it unless you're certain it came from a source you trust.

  2. Check where you got it — an email attachment or a random download link is a red flag.

  3. If you're unsure, delete it. You can always re-download a clean copy from the official source.

  4. If you're still unsure, scan it again in a day or two — detections often catch up on newer files.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
13

Adversary techniques mapped to the MITRE ATT&CK framework.

T1003· Credential theftT1012T1033· Reads user infoT1047T1055· Process injectionT1071· Remote server (C2)T1082· System reconT1203T1485T1497· Sandbox evasionT1564· Hides artifactsT1564.003· Hides artifactsT1573
Spawned processes
14
$(unnamed)
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\attachment.pdf"
$(unnamed)
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"
$(unnamed)
C:\Windows\Explorer.EXE
$(unnamed)
"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference cfc6e614-e52e-4409-943b-42a683785861 0 0
$(unnamed)
"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"
$(unnamed)
"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"
$(unnamed)
C:\Windows\system32\services.exe
$(unnamed)
C:\Windows\System32\svchost.exe -k NetworkService -p
+6 more processes captured.
Filesystem & mutexes
28
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\TmpEA21.tmp
  • C:\Users\<USER>\AppData\Local\Temp\TmpEB89.tmp
  • C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt
  • C:\Users\<USER>\AppData\Local\Temp\NGL\
  • C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
+10 more
Files deleted5
  • C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings
  • C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
  • C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update
  • C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\DC_READER_LAUNCH_CARD
  • C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\ACROBAT_READER_MASTER_SURFACEID
Mutexes created8
  • Local\SessionImmersiveColorMutex
  • Global\_MSIExecute
  • Global\MSILOG_e326b1e21dcf9b9GOL.8ddfISM_pmeT_lacoL_ataDppA_onurB_sresU_:C
  • Global\AdobeCrashProcessorLocalLowLock
  • \Sessions\1\BaseNamedObjects\{100184D2-BDC3-477a-B8D3-65548B67914C}_6784
+3 more
Dropped payload

Files this sample writes at runtime

This file drops 8 children at runtime. None are currently flagged malicious in our cache.

8 unseen
  • eacad3e01b8b0a44ac03…df796dNever scanned
    never seen before
  • 513fb5d3b4195ab59af2…64de2eNever scanned
    never seen before
  • a779a261df447a4c298c…b1b86dNever scanned
    never seen before
  • ad27039abac3252c3b39…37ede5Never scanned
    never seen before
  • 5ec8566c69d8e7a11e9f…593d16Never scanned
    never seen before
  • 81ff65efc4487853bdb4…7c8e06Never scanned
    never seen before
  • abc3179eb66766185190…de8105Never scanned
    never seen before
  • 063693a095538f3b8c9d…d2e2ecNever scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA & heuristic rule matches

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

2 synthesis
MITRE ATT&CK profile
Defense evasion× 1Cred access× 1
MalwareTips synthesis rules
Our own detection rules, applied to the scan data and sandbox behaviour
  • ProcessInjection
    T1055
    high

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    C:\Windows\Explorer.EXE
  • CredentialDumper
    T1003T1003.001
    medium

    Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.

    Evidence
    C:\Windows\system32\lsass.exe
Antivirus engine breakdown

0 detections across 75 engines

0 malicious0 suspicious75 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-241 engines
0flag
Mainstream engines with mixed FP rates
Low-trust17 engines
0flag
Heuristic / generic-AI engines (high FP rate)
All 75 engines report this file as clean.
Hash 2b1a1799462d… cross-referenced against 75 AV engines via our AV network.
Prevalence

How widely this file has been seen

Rarely uploaded, but has been around for a while. Often niche legitimate software or old internal tooling; not a strong malware signal on its own.

Rare & old
Unique uploaders
3
Very few people have ever uploaded this — rare.
Total submissions
3
Includes repeat uploads by the same source.
First seen
8y ago
Jun 30, 2018
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
here
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
6/30/2018, 2:01:26 AM
First seen (MalwareBazaar)
—
Last analysis (VT)
6/11/2026, 4:48:39 AM
Scanned here
7/17/2026, 5:38:24 PM
File name
ipc-whma-a-620b-spdf_compress.pdf
Size
569.4 KB
MIME type
(unknown)
Detected type
PDF
SHA-256
2b1a1799462da96edecf0015c808e9f3ac0dae802ba419abf163bad1828642df
MD5
f22a1cdb70c0a576fb7ae2471b6d1eea
SHA-1
187cc5623f3bf7a33beb907068b724f6343bf0f5
First seen (VT)
6/30/2018, 2:01:26 AM
Last analysis (VT)
6/11/2026, 4:48:39 AM
First scan (MalwareTips)
7/17/2026, 5:38:24 PM
Last scan (MalwareTips)
7/17/2026, 5:38:24 PM
Behavior tags
pdf
Frequently asked

Safety FAQ

Common questions about ipc-whma-a-620b-spdf_compress.pdf, answered from the scan data above.

  • ipc-whma-a-620b-spdf_compress.pdf is suspicious — treat it as unsafe until you're sure. 0 of 75 antivirus engines flag it, which isn't a strong consensus but is enough to be cautious. Don't opened it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
  • ipc-whma-a-620b-spdf_compress.pdf is a document file, about 569 KB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
  • None — all 75 antivirus engines we queried report ipc-whma-a-620b-spdf_compress.pdf as clean. That's reassuring, though brand-new malware can briefly evade detection before vendors add signatures, so we also weigh the file's behaviour and reputation.
  • Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
  • To remove ipc-whma-a-620b-spdf_compress.pdf: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original ipc-whma-a-620b-spdf_compress.pdf file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
  • The SHA-256 hash of ipc-whma-a-620b-spdf_compress.pdf is 2b1a1799462da96edecf0015c808e9f3ac0dae802ba419abf163bad1828642df, and its MD5 is f22a1cdb70c0a576fb7ae2471b6d1eea. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
  • This report reflects the scan run on July 17, 2026. Because a file's hash never changes, the identity of ipc-whma-a-620b-spdf_compress.pdf is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.