File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
Only 1 of the 63 antivirus engines that checked it flagged this new PDF, with no major or independent intelligence corroboration, though its invoice-themed name warrants caution.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Treat unsolicited invoice content cautiously: verify the charge through an independently located official channel and do not use links, phone numbers, or payment instructions in the PDF. Keep security protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 63 flagged
- Flagged 1
- No detection 62
- No result 12
- Code signing Not applicable
- Test run Not run
- First seen 13d ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
McAfeeD alone flagged the PDF as phishing, while no major antivirus engines detected it and no malware-specific intelligence corroborated that label. Because the file is and has not undergone the test run, avoid clicking links or calling numbers in it unless independently verified.
The principal adverse signal is McAfeeD’s phishing label, representing 1 of the 63 antivirus engines that checked it and the only independent detection. All 17 reporting major antivirus engines returned no detection, making the isolated less reliable result more likely to be a false positive than confirmed phishing. No malware-family match or specific YARA rule supports the detection. However, the invoice and security-product theme is compatible with social-engineering lures, and the sample has almost no reputation history. No sandbox execution or complete contacted-host reputation check is available, so embedded destinations and interactive content remain unverified.
What We Detected
McAfeeD was the only engine among 75 to flag the document, labeling it “Trojan:PDF/Phishing.RIA.” No major antivirus engines reported a detection, and external malware intelligence supplied no family match or malware-specific YARA rule.
Threat Behavior
No completed sandbox observation is available, so the document’s links, scripts, forms, and other interactive features were not observed when it ran. A complete reputation check of any possible contacted hosts is also unavailable. The invoice and security-product theme resembles a common fake-order lure, but its original file name (hidden on this page for privacy) alone does not prove harmful content.
What To Do Now
Verify any claimed purchase through the vendor’s official website or a trusted account portal rather than using contact details or links inside the PDF. Keep security software enabled, and delete the document if it arrived unexpectedly or pressures you to call, pay, disclose credentials, or install software.
Where this verdict could be wrong3 caveats
- McAfeeD identifies the document as PDF phishing, and the invoice/security-product-themed filename is consistent with a common social-engineering lure.
- The file is and has only one submission, so its reputation is not yet established.
- No sandbox run or complete host-reputation check is available to verify whether the document contains harmful links or active content.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No major antivirus engines detected the file.
- The sole detection came from a less reliable engine and lacked independent corroboration.
- No malware-family or malware-specific research rule matched the sample.
- No malicious file it created was identified.
- One antivirus engine labeled the PDF as phishing.
- The invoice and security-product theme can be used in fake-order and refund scams.
- The file was first observed on Oct 13, 2026 and has only one known submission.
- No the test run or complete destination-reputation check is available.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
1 of the 63 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- McAfeeDTrojan:PDF/Phishing.RIA
File fingerprint
- File name
- PDF document
- Format
- Size
- 49.7 kB
- Code signing
- Not applicable to this file type
- Last analyzed
- Oct 13, 2026, 12:52 PM UTC
- SHA-256
3eb9a9ad298800abf12d6ec8a4c8acbc74660dc5183a8f58fbfb8064c750d470- SHA-1
88e7308cf3d845321e229a30beb851d8a055b7d1- MD5
298bad893d302162079bcc00f0d6b891
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.