File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
No engine flagged this long-established PDF, although embedded JavaScript and automatic-action features warrant opening it in an updated, protected PDF reader.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 63 flagged
- Flagged 0
- No detection 63
- No result 12
- Code signing Not applicable
- Test run Not run
- First seen 5y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 63 antivirus engines that checked it returned no malicious or suspicious detection, including 17 major antivirus engines, and the PDF has circulated broadly since 2021. Its embedded JavaScript, automatic actions, forms, and encryption are cautionary features, but no threat intelligence or engine evidence corroborates abuse.
The antivirus results are uniformly non-detecting: 0 of the 63 antivirus engines that checked it flagged the file, and all 17 reporting major antivirus engines found no threat. The document is also well established, with 509 sources and 543 submissions dating back to 2021. Research feeds produced no matching malware record or YARA rule. However, embedded JavaScript, automatic actions, forms, and encryption can increase PDF risk and should not be treated as proof of harmlessness by themselves. No sandbox run or complete host-reputation check is available, so the conclusion rests on static scanning, prevalence, and external intelligence.
What We Detected
No malicious or suspicious result was reported by any of the 75 antivirus engines. This includes 17 major antivirus engines, such as Avast, BitDefender, ESET-NOD32, Kaspersky, Microsoft, and Fortinet.
Threat Behavior
The PDF is tagged as encrypted and contains forms, embedded JavaScript, and an automatic action. Those capabilities can be used legitimately in interactive documents, but they can also be abused. No completed sandbox observation is available, and no complete host-reputation result was recorded, so activity in the test run cannot be assessed.
What To Do Now
Open the document only if it came from an expected source, using a fully updated PDF reader while security software remains enabled. Disable JavaScript within the PDF reader if interactive functionality is unnecessary, and avoid clicking unexpected links or permitting external actions.
Where this verdict could be wrong3 caveats
- The PDF has file.tags including autoaction and js-embedded; these features can support document exploits or deceptive actions even though no engine currently detects a threat.
- The encrypted tag may limit static inspection of some content.
- No sandbox execution or complete contacted-host reputation check is available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/63 engines reported a malicious or suspicious result.
- 17 major antivirus engines reported it clean and no major antivirus engines flagged it.
- 509 unique sources submitted the file 543 times.
- The file has been known since Oct 13, 2021.
- YARAify, CIRCL, and MalwareBazaar returned no threat hits.
- Embedded JavaScript is present in the PDF.
- An automatic-action feature is present.
- Encrypted content may reduce static inspection visibility.
- No completed sandbox observation is available.
- No complete contacted-host reputation result is available.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
None of the 63 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 61.8 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 9, 2026, 7:03 PM UTC
- SHA-256
6f0f3a20e828542e8b846d795d480972f26340f7c32689bf5563baf3b4ea71cb- SHA-1
011e47f1e41e79a8143c620e93fa28eccd0b92cc- MD5
bd44a2a043a572363125de4d303e581b
First scanned
Antivirus consensus
0 of 63 engines flagged this file
12 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust12 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.