File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
No antivirus engine detected the long-circulating PDF, and the isolated sandbox technique mappings lack corroborating malware, persistence, or harmful-child evidence.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 62 flagged
- Flagged 0
- No detection 62
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 62 antivirus engines that checked it flagged this PDF, including the major antivirus engines, despite more than five years of circulation and 169 submissions.
The PDF received no malicious or suspicious detections from 74 antivirus engines, with 16 major antivirus engines reporting no detection. It has circulated since February 2021 across 156 sources and 169 submissions, reducing the likelihood that it is an undiscovered active threat. One sandbox mapped credential dumping, process injection, and data destruction techniques, but its recorded evidence merely shows Adobe Acrobat opening the document. The run produced no malicious sandbox verdict or persistence indicators, and none of ten inspected children was identified as malicious. Host-reputation coverage was incomplete because only one host was inspected despite several recorded network contacts, so the network evidence cannot be characterized as fully cleared. No external research rule, known-malware record, engine family label, or malicious-child finding corroborates the concerning rule-based mappings.
What We Detected
The file has been observed since February 2021, with 156 sources submitting it 169 times, yet no malware family label or external research match was found.
Threat Behavior
One sandbox run mapped T1003, T1055, and T1485. However, the saved evidence for T1055 only shows Adobe Acrobat opening the PDF, and the sandbox issued no malicious verdict or persistence finding. Ten written or dropped items were inspected without a malicious-child finding, although their individual verdicts remain unknown. Several IP and URL contacts were recorded, but only one host received a saved reputation check, so complete network-reputation coverage is unavailable.
What To Do Now
Open the document only with a fully updated PDF reader and keep security software enabled. If it came from an unexpected source, verify the sender and avoid interacting with embedded forms, links, or attachments until its origin is confirmed.
Where this verdict could be wrong3 caveats
- The sandbox's offensive-technique list contains T1003, T1055, and T1485, although the saved evidence does not substantiate the specific harmful actions.
- The sandbox recorded direct-IP contacts to 2.17.148.252 and 18.213.11.84; the cross-check of 1 host is incomplete coverage, so their reputation was not fully resolved.
- All 10 files it created have unknown individual verdicts despite the absence of a known-malicious dropped file.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/62 antivirus engines reported malicious or suspicious results.
- Observed since 2021 across 156 sources and 169 submissions.
- No malicious sandbox verdict or persistence indicators.
- No malicious child, YARAify rule, or MalwareBazaar record.
- Sandbox mappings include T1003, T1055, and T1485.
- Direct-IP traffic included 2.17.148.252 and 18.213.11.84.
- Contacted-host reputation coverage was incomplete.
- The PDF carries an AcroForm tag and may contain interactive content.
- Ten child artifacts lack individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 8spawned processes
- 3network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1012
- T1036
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1203
- T1485
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1573
Observed activity
Processes started
8Programs the file ran, with their command lines.
Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\PDF document"Adobe Crash Processor.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"CRWindowsClientService.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference 8a474f36-4313-4198-b8b3-a2ffd4422109 0 0CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"RdrCEF.exec:\program files (x86)\adobe\acrobat reader dc\reader\acrocef_1\RdrCEF.exe --backgroundcolor=16514043
Show all 8 entries for processes started
AdobeARM.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe /PRODUCT:Reader /VERSION:22.0 /MODE:3Reader_sl.exeC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Network contacts
33 hosts, listed as 2 addresses, 1 link. Links show the host and path only.
- IP address
2.17.148.252 - IP address
18.213.11.84 - URL
https://ardownload3.adobe.com/pub/adobe/reader/win/AcrobatDC/2200320310/AcroRdrDCUpd2200320310.msi
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt - Written
C:\Users\<USER>\AppData\Local\Temp\NGL\NGLClient_AcrobatReader123.8.20533.6.log - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp2F01.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\A964s2w7_vxej1i_2bw.tmp - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2532
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2532 - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING - Written
Local\088D5A38 - Written
Local\088D5810 - Written
Local\088D5E88 - Written
Local\088D6728 - Written
Local\08616AE0 - Written
Local\08BFCFB0 - Written
Local\08BFD628 - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents-journal - Deleted
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\DC_READER_LAUNCH_CARD - Deleted
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\ACROBAT_READER_MASTER_SURFACEID - Deleted
C:\Windows\Temp\3959.txt - Deleted
C:\Users\<USER>\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal - Deleted
C:\Users\<USER>\AppData\Local\Temp\A91u15t1n_13pdqxc_1yc.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9zj846s_13pdqxd_1yc.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A91m1kavq_13pdqxe_1yc.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9hx8w60_13pdqxf_1yc.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9ixcy1v_13pdqxg_1yc.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\TmpF8E8.tmp - Deleted
C:\Users\<USER>\AppData\Local\Adobe\ARM\Reader_22.001.20169\ReaderDCManifest3.msi - Deleted
C:\Users\<USER>\AppData\Local\Temp\TmpF985.tmp - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0
Registry and auto-start
5Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cAcrobatUpsellTracking\tTrackingParam - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer\ProductInfoCache - Deleted
HKLM\System\Acrobatviewercpp304 - Deleted
HKLM\System\Acrobatviewercpp473 - Deleted
HKLM\System\WSZXSGANXFJVAYSXYQGNXKQY
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Acrobat Instance MutexLocal\SessionImmersiveColorMutexGlobal\MSILOG_edf248ea1db2693GOL.22c23ISM_pmeT_lacoL_ataDppA_onurB_sresU_:CGlobal\AdobeCrashProcessorLocalLowLockLocal\ZonesCacheCounterMutexLocal\ZonesLockedCacheCounterMutex
Show all 10 entries for mutexes
2AC1A572DB6944B0A65C38C4140AF2F4850744D310CAcrobat Instance MutexDBWinMutex\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM host
8.8.8.8
Files this sample writes at runtime
This file drops 7 children at runtime. None are currently flagged malicious in our cache. 7 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 1b8ec9509c352210e30c…83a3bdNot checkedno saved verdict
- 4cc23dd7d5c2f85a438b…ecfb69Not checkedno saved verdict
- a6ce2291a38cc10f8e64…b90d1eNot checkedno saved verdict
- db8a9d9f7851ae708260…5c0669Not checkedno saved verdict
- 5a52fba50abaf120d281…050a95Not checkedno saved verdict
- c9203c5a3e50b7efbae5…9cc34aNot checkedno saved verdict
- 9df8e969c682f1f44855…20d415Not checkedno saved verdict
Chapter 04
Technical details
None of the 62 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 21.5 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 9, 2026, 7:04 PM UTC
- SHA-256
58e30d5b65824bbff0331dc624be8247cf92ca30f205e343584ccdb137bba986- SHA-1
0047d823fc2b5dc4712e2dcd68c359823f39b5ba- MD5
4bf940f1dd67a7b3d7ad7119bece5db9
First scanned
Antivirus consensus
0 of 62 engines flagged this file
12 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-233 engines0flagged
- Low-trust12 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.