File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
PDF file with zero engine detections, clean sandbox verdict, and no malicious child or host signals.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Open the PDF normally; no further security action is needed.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 13
- Code signing Not applicable
- Test run Completed
- First seen 8y ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 64 antivirus engines that checked it returned clean results and the single sandbox run produced no malicious verdict. The three triggered rules explicitly note that the observed mappings do not prove malicious intent.
Zero malicious detections across major and smaller engines combined with a clean sandbox verdict and no malicious files it created or no complete contacted-host reputation result was available. The synthesis rules that fired are designed to surface possible MITRE mappings rather than confirm malice, and each rule text cautions against treating the mapping as proof. Medium prevalence over nearly nine years with no external-intel hits further supports a safe determination.
What We Detected
77 engines scanned the PDF; none flagged it malicious or suspicious. One sandbox execution recorded MITRE techniques T1003, T1055 and T1485, but the sandbox itself returned no malicious verdict.
Threat Behavior
Contacted IPs include Google DNS and known CDN ranges; no complete contacted-host reputation result was available were identified in our cache.
What To Do Now
The file can be opened with standard PDF readers. Keep security software enabled; no additional action is required.
Where this verdict could be wrong1 caveat
- triggeredHeuristics surfaced high-severity one of our behaviour rules mapping, but the rule itself states it does not prove malicious intent or exact method.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero detections across 77 engines
- Clean sandbox verdict
- No malicious files it created
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 14sandbox rule tags
- 10spawned processes
- 20network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
14MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1012
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1189
- T1203
- T1485
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1573
Observed activity
Processes started
10Programs the file ran, with their command lines.
Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\PDF document"Adobe Crash Processor.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"CRWindowsClientService.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference 2c0ffb51-87a8-4df9-8f35-2769b47143df 0 0CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\updater.exe" --system --windows-service --service=update-internal
Show all 10 entries for processes started
updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=130.0.6679.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2d4,0x2d8,0x2dc,0x2b0,0x2e0,0x116a6cc,0x116a6d8,0x116a6e4RdrCEF.exec:\program files (x86)\adobe\acrobat reader dc\reader\acrocef_1\RdrCEF.exe --backgroundcolor=16514043AdobeARM.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe /PRODUCT:Reader /VERSION:22.0 /MODE:3Reader_sl.exeC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Network contacts
2020 hosts, listed as 18 addresses, 2 links. Links show the host and path only.
- IP address
104.18.10.207 - IP address
18.165.227.82 - IP address
3.215.172.219 - IP address
13.224.245.89 - IP address
104.16.129.114 - IP address
143.204.68.37
Show all 20 entries for network contacts
- IP address
47.246.99.254 - IP address
3.92.120.28 - IP address
141.193.213.20 - IP address
87.248.204.0 - IP address
18.207.85.246 - IP address
23.219.196.131 - IP address
142.250.187.200 - IP address
142.250.187.234 - IP address
216.239.32.36 - IP address
172.217.169.78 - IP address
142.250.179.227 - IP address
104.18.23.52 - URL
https://ardownload3.adobe.com/pub/adobe/reader/win/AcrobatDC/2200320263/AcroRdrDCUpd2200320263.msi - URL
http://taylorandfrancis.com
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt - Written
C:\Users\<USER>\AppData\Local\Temp\NGL\NGLClient_AcrobatReader123.8.20533.6.log - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp9437.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\A9f612dt_1sj5p8e_ls.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\A9iwznat_1sj5p8i_ls.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\A9hj7l31_1sj5p8j_ls.tmp
Show all 30 entries for files
- Written
C:\Program Files (x86)\Google\GoogleUpdater\updater.log - Written
C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\Crashpad\metadata - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1908 - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1908 - Written
Local\0845A100 - Written
Local\0845B240 - Written
Local\082FE2C0 - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Deleted
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\DC_READER_LAUNCH_CARD - Deleted
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\ACROBAT_READER_MASTER_SURFACEID - Deleted
C:\Windows\Temp\13913.txt - Deleted
C:\Users\<USER>\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal - Deleted
C:\Users\<USER>\AppData\Local\Temp\A91evi6t_wlt2l9_1h0.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9nbpsa1_wlt2la_1h0.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9banqwc_wlt2l7_1h0.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A91u6uegh_wlt2l8_1h0.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9cf70la_wlt2lb_1h0.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\TmpECC2.tmp - Deleted
C:\Users\<USER>\AppData\Local\Adobe\ARM\Reader_22.001.20169\ReaderDCManifest3.msi - Deleted
C:\Users\<USER>\AppData\Local\Temp\TmpED8E.tmp - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0
Registry and auto-start
4Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer\ProductInfoCache - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cAcrobatUpsellTracking\tTrackingParam - Deleted
HKLM\System\Acrobatviewercpp473 - Deleted
HKLM\System\WSZXSGANXFJVAYSXYQGNXKQY
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Acrobat Instance MutexGlobal\_MSIExecuteGlobal\MSILOG_c2e901ed1db231bGOL.801a2ISM_pmeT_lacoL_ataDppA_onurB_sresU_:CGlobal\AdobeCrashProcessorLocalLowLockLocal\ZonesCacheCounterMutexLocal\ZonesLockedCacheCounterMutex
Show all 10 entries for mutexes
DBWinMutex\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex\Sessions\1\BaseNamedObjects\DBWinMutex\Sessions\1\BaseNamedObjects\com.adobe.acrobat.rna.RdrCefBrowserLock.DC
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM host
8.8.8.8
Files this sample writes at runtime
This file drops 7 children at runtime. None are currently flagged malicious in our cache. 7 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 4f6d33bcbe47aa69e38c…39a390Not checkedno saved verdict
- ea04550db3423335bb52…2708afNot checkedno saved verdict
- ecf329f42674b1db0d2b…6f64a2Not checkedno saved verdict
- a6ce2291a38cc10f8e64…b90d1eNot checkedno saved verdict
- 178445d94de1694a5936…33c1ceNot checkedno saved verdict
- 7a5cf34252a1fa36d9fb…738e8fNot checkedno saved verdict
- 8233d8ef22fa949d4b6b…07c301Not checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 46.0 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Aug 25, 2026, 7:22 AM UTC
- SHA-256
549e2e532213b0583710c538d889d2026a3fe06ca9b24181e5543a58b5d4c56c- SHA-1
0d622e30828317594c601023fad96c187218867f- MD5
d1832864c60f3926c0b44ad65be91969
First scanned
Antivirus consensus
0 of 64 engines flagged this file
13 of the 77 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust12 engines0flagged
View all 77 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeClean
- McAfeeDNo result
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.