File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
This PDF document drew no detections from any of 75 antivirus engines, and sandbox runs showed only normal Adobe Acrobat activity with no harmful behaviour.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This PDF document appears safe to open. Keep your PDF reader up to date and your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 63 flagged
- Flagged 0
- No detection 63
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 63 antivirus engines that checked it flagged this PDF document, including every major antivirus engine. Four sandbox runs opened it in Adobe Acrobat and recorded only the reader's own processes and Adobe or Microsoft service traffic. It contains form scripting, which is common in interactive PDFs.
None of the 63 antivirus engines that checked it flagged the file, and all 18 major antivirus engines reported it clean. Four sandbox runs opened it and saw only Adobe Acrobat and its helper processes. Network traffic went to Adobe data and Microsoft background hosts, and none of the 13 hosts we checked is known to be malicious. The injection and credential-related labels came from generic sandbox mappings, with no target process recorded. Public malware databases and community rule sets have no entry for this hash. The embedded JavaScript and auto-action flags fit an interactive form document and are not corroborated by any other evidence.
What We Detected
No antivirus detections: 0 of the 63 antivirus engines that checked it flagged this PDF document, and all major antivirus engines returned clean results. Public malware databases and community YARA rule sets returned no matches.
Threat Behavior
Four sandbox runs opened the document in Adobe Acrobat. They recorded only Acrobat, its embedded browser component and its collaboration sync helper. Network contacts went to Adobe data and Microsoft content hosts, and no process was injected into. The document contains form scripting and an automatic action, which is typical of interactive PDFs, and no harmful effect was observed.
What To Do Now
The document can be opened normally. As a general precaution, keep your PDF reader updated, and consider disabling JavaScript in the reader if you do not need interactive forms.
Where this verdict could be wrong1 caveat
- The document carries embedded JavaScript and an automatic action. These are common in form-enabled PDFs but can also be abused; our own static analysis of the bytes was not available to inspect them.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 63 antivirus engines that checked it flagged the file.
- Four sandbox runs showed only normal Adobe Acrobat activity.
- None of the 13 contacted hosts is known to be malicious or suspicious.
- No listings in public malware databases or community rule sets.
- The document contains embedded JavaScript and an automatic action, a feature set that is occasionally abused in malicious PDFs.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 11sandbox rule tags
- 11spawned processes
- 9network contacts
- 35filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1012
- T1036
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1203
- T1485
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1573
Observed activity
Processes started
11Programs the file ran, with their command lines.
Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\PDF document"Adobe Crash Processor.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"RdrCEF.exec:\program files (x86)\adobe\acrobat reader dc\reader\acrocef_1\RdrCEF.exe --backgroundcolor=16514043Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\PDF document"AcroCEF.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215AcroCEF.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/25.1.20435 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\UserData" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1712,i,16154158095344081946,11359785163620340592,131072 --disable-features=BackForwardCache,CalculateNativeWinOc…
Show all 11 entries for processes started
AdobeCollabSync.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -cAdobeCollabSync.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=3352FullTrustNotifier.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe" GetChannelUriAdobeCollabSync.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=6804AdobeCollabSync.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe" -c --type=collab-renderer --proc=5472
Network contacts
99 hosts, listed as 6 domains, 3 addresses. Links show the host and path only.
- Domain
acroipm2.adobe.com - Domain
ethos.dunamis.ethos508-prod-va6.ethos.adobe.net - Domain
dunamis-ethos508-prod-va6-856defacfb833db1.elb.us-east-1.amazonaws.com - Domain
www.msn.com.edgekey.net - Domain
e592.d.akamaiedge.net - Domain
api.msn.com
Show all 9 entries for network contacts
- IP address
52.6.228.48 - IP address
23.198.74.242 - IP address
23.60.131.209
Files
25Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt - Written
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1180 - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1180
Show all 25 entries for files
- Written
Local\08B916A8 - Written
Local\08F38438 - Written
Local\0945A610 - Written
Local\0945BBA0 - Written
Local\094CB7D0 - Written
Local\08F399C8 - Written
Local\0954E338 - Written
Local\096880C8 - Written
Local\097212B8 - Deleted
C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update - Deleted
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\DC_READER_LAUNCH_CARD - Deleted
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\ACROBAT_READER_MASTER_SURFACEID - Deleted
C:\Users\<USER>\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9dwnzn0_1mleogp_ws.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9wdr6pn_1mleogq_ws.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A91mybf87_1mleogr_ws.tmp - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Deleted
C:\Users\<USER>\AppData\Local\Temp\A91dfxapa_1mleogs_ws.tmp
Registry and auto-start
19Settings the file changed, including ways to start again after a restart.
- Set
Software\Adobe\Acrobat Reader\DC\ExitSection\bLastExitNormal - Set
Software\Adobe\Adobe Acrobat\DC\DiskCabs\bForms_AdhocWorkflowBackup - Set
SOFTWARE\Adobe\Acrobat Reader\DC\DLLInjection\bBlockDLLInjection - Set
Software\Adobe\Acrobat Reader\DC\SessionManagement\bNormalExit - Set
cPathInfo\sDI - Set
cPathInfo\tDIText
Show all 19 entries for registry and auto-start
- Set
cPathInfo\aFS - Set
cTab0\tfilename - Set
cWin0\iTabCount - Set
cWindowsCurrent\iWinCount - Set
c1\sDate - Set
c1\iFavorite - Set
c1\tFileName - Set
c1\uFileSize - Set
c1\tFileSource - Deleted
HKEY_LOCAL_MACHINE\System\Acrobatviewercpp473 - Deleted
HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles - Deleted
HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1 - Deleted
HKEY_LOCAL_MACHINE\SYSTEM\Acrobatbrokerserverdispatchercpp789
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Global\_MSIExecuteGlobal\AdobeCrashProcessorLocalLowLockGlobal\OneSettingQueryMutex+compat+encapsulation\Sessions\1\BaseNamedObjects\{100184D2-BDC3-477a-B8D3-65548B67914C}_1364\Sessions\1\BaseNamedObjects\Local\{100184D2-BDC3-477a-B8D3-65548B67914C}_3172\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex
Show all 10 entries for mutexes
\Sessions\1\BaseNamedObjects\Global\{100184D2-BDC3-477a-B8D3-65548B67914C}_4356\Sessions\1\BaseNamedObjects\Global\_MSIExecute\Sessions\1\BaseNamedObjects\com.adobe.acrobat.rna.AcroCefBrowserLock.DC\Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__
Sandbox background — not the file
9The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM host
assets.msn.com - VM host
assets.msn.com-ion.edgesuite.net
Show all 9 entries for sandbox background — not the file
- VM host
a1666.dscr.akamai.net - VM host
www.msn.com - VM host
8.8.8.8
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 687fbe4b7d34843b9240…5a5402Not checkedno saved verdict
- 226eec4486509917aa33…21a974Cleantrust 85known-software reference set · not scanned here
- 016997b6d42526f789b9…7c64bfNot checkedno saved verdict
- 02f0200e2f938cc66e3d…960eb1Not checkedno saved verdict
- 7c51730366097079d13b…80593cNot checkedno saved verdict
- 59d3b7a19a6012d4b6fe…da4f5eNot checkedno saved verdict
- fe866b6fb49870b4cbca…de325bNot checkedno saved verdict
- b60d6113e5a2ad3d98af…8a383bNot checkedno saved verdict
- bfdc03503d5578f24720…bb6a2aNot checkedno saved verdict
- a5c6d4dbae668479ccb9…11631bNot checkedno saved verdict
Chapter 04
Technical details
None of the 63 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 48.7 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Oct 22, 2026, 5:41 PM UTC
- SHA-256
60680310d4c48d5d27dad7bfaf6b36b9bd7baaf8db5195f828240be880f29434- SHA-1
746072ee35fd048913e3e2d79aaa96d89a09fa81- MD5
592ed80cad6f903e9e35cc8693f4ef3f
First scanned
Antivirus consensus
0 of 63 engines flagged this file
12 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-232 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.