File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
No antivirus engine detected the long-established PDF, while isolated sandbox technique mappings lack a malicious verdict or independent threat-intelligence corroboration.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 13y ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 64 antivirus engines that checked it flagged this PDF, including all 17 participating major antivirus engines, and the completed sandbox issued no malicious verdict. Two offensive technique mappings and direct-IP traffic warrant ordinary caution, but they are not corroborated by detections, malicious files it created, or researcher rules.
The strongest evidence is the complete absence of detections across 76 antivirus engines, with all 17 participating major antivirus engines silent. The file has also been observed for more than 13 years and submitted 32 times by 29 sources, reducing concern that it is an untested recent sample. One sandbox mapped and T1485, but it produced no malicious verdict and no inspected child was identified as malicious. Three external IP contacts triggered a rule, yet no complete host-reputation result is available because the contacted-host check was not saved. No matching researcher rule, known-malware record, or named family provides independent corroboration.
What We Detected
None of the 64 antivirus engines that checked it flagged the PDF, including all 17 participating major antivirus engines. The hash has been known since 2013 and has 32 submissions from 29 sources. No named malware family, researcher rule, or known-malware intelligence hit was present.
Threat Behavior
One sandbox completed execution without issuing a malicious verdict. It mapped MITRE techniques T1003 and T1485 and observed direct connections to 142.250.125.94, 184.30.16.138, and 34.193.227.236. Those mappings are concerning in isolation, but they are not backed by process evidence showing credential theft or destructive actions. A complete reputation check for the contacted hosts is unavailable. Ten dropped files were inspected without a malicious-child finding, although their individual verdicts remain unknown.
What To Do Now
Open the document only with a fully updated PDF reader and keep security software enabled. If the source is unfamiliar or the document requests scripts, embedded files, credentials, or external downloads, close it and obtain another copy from a trusted source.
Where this verdict could be wrong3 caveats
- The sandbox mapped and T1485, techniques associated with credential access and destructive activity, although it issued no malicious verdict.
- One of our behaviour rules fired for three external IP addresses, and the missing contacted-host reputation result leaves their reputation unresolved.
- All 10 inspected files it created have unknown individual verdicts, so dropped-file evidence is incomplete rather than affirmatively benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/64 antivirus engines reported a detection.
- No sandbox returned a malicious verdict.
- No dropped file is known to be malicious.
- No YARAify, MalwareBazaar, or CIRCL hit was recorded.
- Sandbox mapped offensive techniques and T1485.
- Direct-IP behaviour rule matched for 142.250.125.94, 184.30.16.138, and 34.193.227.236.
- No contacted-host reputation result was saved, so the observed IP addresses lack a complete saved reputation check.
- The PDF carries autoaction, runtime-modules, and acroform tags.
- Ten files it created have unknown individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 5spawned processes
- 3network contacts
- 40filesystem & mutex artifacts
Includes 10 mapped techniques, every process, file, registry and network entry and 9 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 16.5 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 9, 2026, 8:08 PM UTC
- SHA-256
871e29c2677b868cdc4ff43e6a0fccddc1a33dc69646cebce7ca60b071b6b363- SHA-1
317a58c72fa6bf91557a3426b31f5067e7b2a108- MD5
0d6f773da41da789172d5e8fffbcc579
First scanned
Includes every engine result (76), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.