File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
No antivirus engine detected the long-circulating PDF, and the isolated sandbox technique mappings lack corroborating malware, persistence, or harmful-child evidence.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 62 flagged
- Flagged 0
- No detection 62
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 62 antivirus engines that checked it flagged this PDF, including the major antivirus engines, despite more than five years of circulation and 169 submissions.
The PDF received no malicious or suspicious detections from 74 antivirus engines, with 16 major antivirus engines reporting no detection. It has circulated since February 2021 across 156 sources and 169 submissions, reducing the likelihood that it is an undiscovered active threat. One sandbox mapped credential dumping, process injection, and data destruction techniques, but its recorded evidence merely shows Adobe Acrobat opening the document. The run produced no malicious sandbox verdict or persistence indicators, and none of ten inspected children was identified as malicious. Host-reputation coverage was incomplete because only one host was inspected despite several recorded network contacts, so the network evidence cannot be characterized as fully cleared. No external research rule, known-malware record, engine family label, or malicious-child finding corroborates the concerning rule-based mappings.
What We Detected
The file has been observed since February 2021, with 156 sources submitting it 169 times, yet no malware family label or external research match was found.
Threat Behavior
One sandbox run mapped T1003, T1055, and T1485. However, the saved evidence for T1055 only shows Adobe Acrobat opening the PDF, and the sandbox issued no malicious verdict or persistence finding. Ten written or dropped items were inspected without a malicious-child finding, although their individual verdicts remain unknown. Several IP and URL contacts were recorded, but only one host received a saved reputation check, so complete network-reputation coverage is unavailable.
What To Do Now
Open the document only with a fully updated PDF reader and keep security software enabled. If it came from an unexpected source, verify the sender and avoid interacting with embedded forms, links, or attachments until its origin is confirmed.
Where this verdict could be wrong3 caveats
- The sandbox's offensive-technique list contains T1003, T1055, and T1485, although the saved evidence does not substantiate the specific harmful actions.
- The sandbox recorded direct-IP contacts to 2.17.148.252 and 18.213.11.84; the cross-check of 1 host is incomplete coverage, so their reputation was not fully resolved.
- All 10 files it created have unknown individual verdicts despite the absence of a known-malicious dropped file.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/62 antivirus engines reported malicious or suspicious results.
- Observed since 2021 across 156 sources and 169 submissions.
- No malicious sandbox verdict or persistence indicators.
- No malicious child, YARAify rule, or MalwareBazaar record.
- Sandbox mappings include T1003, T1055, and T1485.
- Direct-IP traffic included 2.17.148.252 and 18.213.11.84.
- Contacted-host reputation coverage was incomplete.
- The PDF carries an AcroForm tag and may contain interactive content.
- Ten child artifacts lack individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 8spawned processes
- 3network contacts
- 40filesystem & mutex artifacts
Includes 12 mapped techniques, every process, file, registry and network entry and 7 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 62 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 21.5 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 9, 2026, 7:04 PM UTC
- SHA-256
58e30d5b65824bbff0331dc624be8247cf92ca30f205e343584ccdb137bba986- SHA-1
0047d823fc2b5dc4712e2dcd68c359823f39b5ba- MD5
4bf940f1dd67a7b3d7ad7119bece5db9
First scanned
Includes every engine result (74), 2 matched signature rules and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.