File scan report

Verdict Safe

Analyzed Oct 18, 20268 days ago

Is this PDF document safe? Yes, no threats found.

This PDF document is widely seen since 2018, flagged by none of the 63 antivirus engines that checked it, and only launched normal Adobe Reader activity in sandbox analysis.

Read the whole reasonShow less

Strong evidence · Widely seen for a long time, and nothing harmful found.

Open it as usual if it came from the official source

This PDF document can be opened normally; keep your PDF reader up to date and your antivirus enabled.

Good practice2 tips

We found nothing harmful in this file.

Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Antivirus results

0 of 63 flagged

Flagged 0
No detection 63
No result 12

FilePDF document13.3 kBSHA-256 3df79d34abbc…e6adb4

Code signing Not applicable
Test run Completed
First seen 8y ago

It has a long history: seen by 1,092 sources over more than six months.

Chapter 02

Why we think so

0 points against it and 5 in its favour, checked against the scan evidence.

Analyst conclusion

Across four sandbox runs it only opened in Adobe Reader, which contacted Adobe update servers, with no injection or hostile behaviour recorded. It has been submitted by over a thousand sources since 2018.

Where this verdict could be wrong1 caveat

The hash also appears in an open-upload sample feed, but that feed accepts any file, including dummy PDFs, and no engine, rule or sandbox run corroborates it.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 4 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete

4isolated sandbox runs
7sandbox rule tags
4spawned processes
11network contacts
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was detonated in 4 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

VT: CLEANclean

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1003· Credential theft
T1003.002· Credential theft
T1036
T1071· Application protocol
T1071.001· Application protocol
T1082· System recon
T1203

Observed activity

Processes started

Programs the file ran, with their command lines.

Adobe_Updater.exeC:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe -doActionAppID=reader9rdr-es_ES
RdrCEF.exec:\program files (x86)\adobe\acrobat reader dc\reader\acrocef_1\RdrCEF.exe --backgroundcolor=16514043
AdobeARM.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe /PRODUCT:Reader /VERSION:22.0 /MODE:3
Reader_sl.exeC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe

Network contacts

11 hosts, listed as 7 domains, 4 addresses, 2 links. Links show the host and path only.

Domainssl.adobe.com.edgekey.net
Domainswupmf.adobe.com
Domaine4578.dscb.akamaiedge.net
Domainarmmf.adobe.com
Domainacroipm2.adobe.com
Domaingeo2.adobe.com

Show all 13 entries

Domainp13n.adobe.io
IP address209.197.3.8
IP address23.46.201.17
IP address52.5.13.197
IP address23.210.252.251
URLhttp://swupmf.adobe.com/manifest/60/win/reader9rdr-es_ES.upd
URLhttp://swupmf.adobe.com/manifest/60/win/AdobeUpdater.upd

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst
WrittenC:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst
WrittenC:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\9.0\UserCache.bin
WrittenC:\Users\<USER>\AppData\Local\Adobe\Updater6\AdobeUpdaterPrefs.dat
WrittenC:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json
WrittenC:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2712

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2712
WrittenC:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING
WrittenLocal\07B82EC0
WrittenC:\Users\<USER>\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-230105223337Z-185.bmp
WrittenC:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\UserCache.bin
WrittenC:\Windows\Temp\30498.txt
WrittenC:\Windows\Temp\ArmReport.ini
WrittenC:\Windows\Temp\ArmUI.ini
WrittenC:\Users\<USER>\AppData\Local\Temp\A9p39zri_1klqw4r_23c.tmp
DeletedC:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents-journal
DeletedC:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\DC_READER_LAUNCH_CARD
DeletedC:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\ACROBAT_READER_MASTER_SURFACEID
DeletedC:\Windows\Temp\30498.txt
DeletedC:\Users\<USER>\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
DeletedC:\Users\<USER>\AppData\Local\Temp\A9p39zri_1klqw4r_23c.tmp
DeletedC:\Users\<USER>\AppData\Local\Temp\A9la9x68_1klqw4s_23c.tmp
DeletedC:\Users\<USER>\AppData\Local\Temp\A9eoooxa_1klqw4t_23c.tmp
DeletedC:\Users\<USER>\AppData\Local\Temp\A91tev5qo_1klqw4u_23c.tmp
DeletedC:\Users\<USER>\AppData\Local\Temp\A91b6ekq7_1klqw4v_23c.tmp
DeletedC:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings
DeletedC:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0
DeletedC:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0
DeletedC:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0
DeletedC:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

SetHKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\ExitSection\bLastExitNormal
SetSoftware\Adobe\Acrobat Reader\9.0\AVGeneral\bLastExitNormal
SetSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
SetSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
SetHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix
SetHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix

Show all 18 entries

SetHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix
Set{F115BBD5-AD2B-4438-8A9A-846B11321978}\WpadDecisionReason
Set{F115BBD5-AD2B-4438-8A9A-846B11321978}\WpadDecisionTime
Set{F115BBD5-AD2B-4438-8A9A-846B11321978}\WpadDecision
Set{F115BBD5-AD2B-4438-8A9A-846B11321978}\WpadNetworkName
SetSoftware\Adobe\Acrobat Reader\DC\ExitSection\bLastExitNormal
SetSOFTWARE\Adobe\Acrobat Reader\DC\DLLInjection\bBlockDLLInjection
SetSoftware\Adobe\Acrobat Reader\DC\SessionManagement\bNormalExit
SetcPathInfo\sDI
DeletedHKLM\System\Acrobatviewercpp304
DeletedHKLM\System\Acrobatviewercpp473
DeletedHKLM\System\WSZXSGANXFJVAYSXYQGNXKQY

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

Local\Acrobat Instance Mutex
{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCHBBHMFGAAAAA
2AC1A572DB6944B0A65C38C4140AF2F482874A9310C
Acrobat Instance Mutex
lkwTlhlkBl4nLa+RZHh5Ig==
5cc/lvbQhsQNME+6NHD/xg==

Show all 10 entries

2AC1A572DB6944B0A65C38C4140AF2F4ae0011833B0
dbaKfjcoZqEY5BO9qnLWOg==
2AC1A572DB6944B0A65C38C4140AF2F4ae0011833B8
Cx7Rk2iEn5RNj416G9273w==

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM hostx1.c.lencr.org
VM host8.8.8.8

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

ebc76e937ed2a75bbaa9…aeda67Not checked
no saved verdict
a6ce2291a38cc10f8e64…b90d1eNot checked
no saved verdict
5fbf59aa56ce8a717502…9f82bcNot checked
no saved verdict
90b8d0d7898d2e5ed1ef…bfeaa2Not checked
no saved verdict
0882ce2127db2e157ba2…9e034eNot checked
no saved verdict
9df8e969c682f1f44855…20d415Not checked
no saved verdict
b4d4dcd9594d372d7c0c…2f18b0Not checked
no saved verdict
814098c065a69db2ad08…ab7d27Not checked
no saved verdict
281d182fc7c823420aa0…7502aeNot checked
no saved verdict
ee3af4c46bda773d17d4…f8d35fNot checked
no saved verdict

Chapter 04

Technical details

None of the 63 antivirus engines that checked it flag it.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 63 engines flagged it · 12 gave no result DetailsOct 15, 2026

Sandbox runVirusTotal sandboxes · CAPE Sandbox, VirusTotal Jujubox, VirusTotal ObserverComplete4 runs: 1 clean, 3 without a verdict DetailsOct 18, 2026

Contacted hostsMalwareTips URL scannerComplete12 contacted hosts checked DetailsOct 18, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsOct 18, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 18, 2026

Known-software referenceCIRCL hashlookupCompleteListed in an open-upload malware feedOct 18, 2026

File fingerprint

File name: PDF document
Format: PDF
Size: 13.3 kB
Code signing: Not applicable to this file type
Last analyzed: Oct 18, 2026, 5:06 PM UTC

SHA-256: 3df79d34abbca99308e79cb94461c1893582604d68329a41fd4bec1885e6adb4
SHA-1: 90ffd2359008d82298821d16b21778c5c39aec36
MD5: 2942bfabb3d05332b66eb128e0842cff

First scanned Sep 1, 2026Updated Oct 18, 2026

Verdict history

Sep 1, 2026Malicious
Oct 18, 2026Safeafter a new scan

Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.

Antivirus consensus

0 of 63 engines flagged this file

0 malicious0 suspicious63 not flagged12 no result

12 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-233 engines
0flagged
Low-trust12 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaNo result
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXNo result
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctNo result
DrWebClean
ElasticNo result
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoNo result
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisNo result
TencentClean
TrapmineNo result
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootNo result
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Cred access× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

CredentialDumper
T1003 T1003.001
low
VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
Evidence
T1003 (sandbox MITRE mapping)

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

1,092

Hundreds of people have uploaded this — common.

Total submissions

5,378

Includes repeat uploads by the same source.

First seen

8y ago

Jun 29, 2018

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is this PDF document safe?

We found nothing harmful in this PDF document. None of the 63 antivirus engines that checked it flag it. Open it only if you trust the person or website it came from.

What is this PDF document?

This PDF document is about 13.3 kB. Its original file name is hidden on this page for privacy, so we identify it by its SHA-256 fingerprint. VirusTotal first saw it on Jun 29, 2018.

How many antivirus engines detected this PDF document?

None of the 63 antivirus engines that checked it flag this PDF document. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

What is the SHA-256 hash of this PDF document?

The SHA-256 fingerprint of this PDF document is 3df79d34abbca99308e79cb94461c1893582604d68329a41fd4bec1885e6adb4, and its MD5 is 2942bfabb3d05332b66eb128e0842cff. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to open this PDF document?

We found nothing harmful in this PDF document. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of this PDF document?

This report reflects the scan on Oct 18, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is this PDF document safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

Verdict history

0 of 63 engines flagged this file

Signatures and behavior heuristics

How widely this file has been seen

Questions & answers

Community

Is this PDF document safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

Verdict history

Related file reports