File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
No antivirus engine detected the long-established PDF, while isolated sandbox technique mappings lack a malicious verdict or independent threat-intelligence corroboration.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 12
- Code signing Not applicable
- Test run Completed
- First seen 13y ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 64 antivirus engines that checked it flagged this PDF, including all 17 participating major antivirus engines, and the completed sandbox issued no malicious verdict. Two offensive technique mappings and direct-IP traffic warrant ordinary caution, but they are not corroborated by detections, malicious files it created, or researcher rules.
The strongest evidence is the complete absence of detections across 76 antivirus engines, with all 17 participating major antivirus engines silent. The file has also been observed for more than 13 years and submitted 32 times by 29 sources, reducing concern that it is an untested recent sample. One sandbox mapped and T1485, but it produced no malicious verdict and no inspected child was identified as malicious. Three external IP contacts triggered a rule, yet no complete host-reputation result is available because the contacted-host check was not saved. No matching researcher rule, known-malware record, or named family provides independent corroboration.
What We Detected
None of the 64 antivirus engines that checked it flagged the PDF, including all 17 participating major antivirus engines. The hash has been known since 2013 and has 32 submissions from 29 sources. No named malware family, researcher rule, or known-malware intelligence hit was present.
Threat Behavior
One sandbox completed execution without issuing a malicious verdict. It mapped MITRE techniques T1003 and T1485 and observed direct connections to 142.250.125.94, 184.30.16.138, and 34.193.227.236. Those mappings are concerning in isolation, but they are not backed by process evidence showing credential theft or destructive actions. A complete reputation check for the contacted hosts is unavailable. Ten dropped files were inspected without a malicious-child finding, although their individual verdicts remain unknown.
What To Do Now
Open the document only with a fully updated PDF reader and keep security software enabled. If the source is unfamiliar or the document requests scripts, embedded files, credentials, or external downloads, close it and obtain another copy from a trusted source.
Where this verdict could be wrong3 caveats
- The sandbox mapped and T1485, techniques associated with credential access and destructive activity, although it issued no malicious verdict.
- One of our behaviour rules fired for three external IP addresses, and the missing contacted-host reputation result leaves their reputation unresolved.
- All 10 inspected files it created have unknown individual verdicts, so dropped-file evidence is incomplete rather than affirmatively benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/64 antivirus engines reported a detection.
- No sandbox returned a malicious verdict.
- No dropped file is known to be malicious.
- No YARAify, MalwareBazaar, or CIRCL hit was recorded.
- Sandbox mapped offensive techniques and T1485.
- Direct-IP behaviour rule matched for 142.250.125.94, 184.30.16.138, and 34.193.227.236.
- No contacted-host reputation result was saved, so the observed IP addresses lack a complete saved reputation check.
- The PDF carries autoaction, runtime-modules, and acroform tags.
- Ten files it created have unknown individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 5spawned processes
- 3network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1012
- T1036
- T1071· Application protocol
- T1082· System recon
- T1203
- T1485
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1573
Observed activity
Processes started
5Programs the file ran, with their command lines.
Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\PDF document"Adobe Crash Processor.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"CRWindowsClientService.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference 48c617ec-e4ff-4f3e-8f21-d54bc8b6a7c2 0 0CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"
Network contacts
33 hosts, listed as 3 addresses. Links show the host and path only.
- IP address
142.250.125.94 - IP address
184.30.16.138 - IP address
34.193.227.236
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt - Written
C:\Users\<USER>\AppData\Local\Temp\NGL\NGLClient_AcrobatReader123.8.20533.6.log - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp8A35.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp8E3D.tmp - Written
C:\Users\user\AppData\LocalLow - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache
Show all 30 entries for files
- Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_2 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_3 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\index - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0
Registry and auto-start
3Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cOnboardingContextual\sLastTimeShown - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cAcrobatUpsellTracking\tTrackingParam - Deleted
HKLM\System\Acrobatviewercpp304
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Acrobat Instance MutexGlobal\_MSIExecuteGlobal\MSILOG_d402cd331daf7dcGOL.04aa2ISM_pmeT_lacoL_ataDppA_onurB_sresU_:CGlobal\AdobeCrashProcessorLocalLowLockLocal\ZonesCacheCounterMutexLocal\ZonesLockedCacheCounterMutex
Show all 10 entries for mutexes
Global\OneSettingQueryMutex+compat+encapsulation2AC1A572DB6944B0A65C38C4140AF2F451070BB310CAcrobat Instance Mutex\Sessions\1\BaseNamedObjects\{100184D2-BDC3-477a-B8D3-65548B67914C}_4172
Sandbox background — not the file
4The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM host
224.0.0.251
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 8476839229c419e2bbf7…84948aNot checkedno saved verdict
- a2acabbb218e9a1205b9…0367abNot checkedno saved verdict
- 610bd324afb0f74bf298…54abb5Not checkedno saved verdict
- dedead640d6edcdca083…dea262Not checkedno saved verdict
- 7999c4c84beceb4caa30…43366fNot checkedno saved verdict
- 766caff7446bad3369f3…629366Not checkedno saved verdict
- 244e92fad2d802691976…ceec27Not checkedno saved verdict
- 1015de23015d3edfb46c…e8d014Not checkedno saved verdict
- 8aa0011c981eed009959…f15e2dNot checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 16.5 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 9, 2026, 8:08 PM UTC
- SHA-256
871e29c2677b868cdc4ff43e6a0fccddc1a33dc69646cebce7ca60b071b6b363- SHA-1
317a58c72fa6bf91557a3426b31f5067e7b2a108- MD5
0d6f773da41da789172d5e8fffbcc579
First scanned
Antivirus consensus
0 of 64 engines flagged this file
12 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.