Suspicious
Single tier-1 phishing label on a brand-new unsigned PDF with no sandbox or multi-engine confirmation.
7b7606a6b4d8d5183f…d9d603707bThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The payload shows a lone tier-1 malicious result against a backdrop of broad clean reporting and completely benign sandbox telemetry. Filename and threat label hint at phishing intent, yet the absence of corroborating signals from other engines, external intel, or runtime artifacts prevents a malicious verdict. Similar-hash RAG provides no additional context. This mixed evidence profile matches the borderline-mixed-signals pattern.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.topDetections[0]: Fortinet tier1 result=PDF/Phishing.QRC!tr
file.popularThreatLabel=phishing. and filenameAnalysis evidence of email lure pattern
prevalence.classification=rare_new with firstSubmissionDate 0 days old
behaviour.hasMaliciousSandboxVerdict=false and droppedChildren.hasMaliciousChild=false
- 16 tier-1 engines reported clean
- No malicious sandbox verdict
- No contacted malicious hosts or dropped malicious children
- Single tier-1 phishing detection
- Email-style filename suggesting targeted lure
- Zero-day submission with rare prevalence
Quarantine the file and do not open it; request an alternative delivery method from the apparent sender.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
- C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json
- C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING
- Local\07F84778
- Local\07C14DF8
- Local\07F85AE0
- C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\DC_READER_LAUNCH_CARD
- C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\ACROBAT_READER_MASTER_SURFACEID
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache.
- ad27039abac3252c3b39…37ede5Never scannednever seen before
- 61ba57adc66672639bfb…0b68dcNever scannednever seen before
- 81ff65efc4487853bdb4…7c8e06Never scannednever seen before
- 278165575687daf6392e…e90a09Never scannednever seen before
- bdee182473d254ab5424…9a28d3Never scannednever seen before
- e3b0c44298fc1c149afb…52b855Never scannednever seen before
1 detection across 75 engines
How often this file shows up in the wild
Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.
Forensic fingerprint
- File name
- saraba@pdsbnet.ca_Provincial and demonstration schools branch.pdf
- Size
- 85.0 KB
- MIME type
- (unknown)
- Detected type
- SHA-256
- 7b7606a6b4d8d5183f08778241b133a038cdaa6fe8b8a4d1e18faed9d603707b
- MD5
- d4b14b73f16764f88648813261b4a61e
- SHA-1
- 376158e679ff8974671b26646a5bace9890e977f
- First seen (VT)
- 5/25/2026, 8:31:45 AM
- Last analysis (VT)
- 5/25/2026, 8:31:45 AM
- First scan (MalwareTips)
- 5/25/2026, 8:38:26 AM
- Last scan (MalwareTips)
- 5/25/2026, 8:38:26 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.