File scan report
Verdict Low Risk
Is this PDF document safe? Not fully confirmed.
No engine flags this encrypted PDF and sandbox runs looked normal, but its tender-portal style name fits common phishing lures and its links were never examined.
Read the whole reasonShow less
Why not Safe? We could not confirm who made it.
Limited evidence · Nothing points to a problem, but little confirms who made it.
Verify with the sender through a separate, known channel before trusting this document. Never enter credentials on a site opened from a link inside it.
Good practice3 tips
Low Risk: no threat found, but we could not fully confirm this file.
Get it from the publisher's own website or app store, not from a re-upload or a link someone sent you.
Keep your security software on, and stop if the file does anything you didn't expect.
It is less than a day old. If you're unsure, scan it again in a few days; antivirus engines often catch up on new files.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen Today
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 61 antivirus engines that checked it flagged this PDF document, and four sandbox runs showed only normal Adobe Acrobat activity. However, it is an encrypted e-mail attachment first seen on Oct 26, 2026, with a name typical of document-portal phishing. Nobody has inspected the links it contains, so its safety cannot be confirmed.
None of the 61 antivirus engines that checked it flagged the file, including all 18 major antivirus engines. The four sandbox runs opened it in Acrobat and recorded only the reader's own helper processes and a connection to an Adobe host, with no injection or credential access. The mapped process-injection and credential-dumping techniques had no supporting artefact and are routine on clean documents. Even so, phishing PDFs usually work through a link to a fake login page, which engines and sandboxes rarely catch. This file is encrypted, was sent as an attachment and uses a tender-portal style name, and its links were not examined. No reference database or wide distribution vouches for it either.
What We Detected
None of the 61 antivirus engines that checked it flagged this PDF document. It carries encrypted and attachment tags, was first seen on Oct 26, 2026, and has been submitted by nine sources. No malware database or community rule lists it.
Threat Behavior
Four sandbox runs opened the document in Adobe Acrobat. They observed only the reader, its crash and log helpers, and a connection to an Adobe service host. No process injection or credential access was recorded. The document's name fits the shared tender or 'secure portal' lure common in phishing campaigns. Its embedded links were not inspected, so a credential-phishing link cannot be ruled out.
What To Do Now
If you received this file unexpectedly, confirm with the sender through a known contact method before opening it. Do not enter any login details on a page reached from a link inside the document.
Where this verdict could be wrong1 caveat
- The sandbox opened the document in Acrobat and saw only ordinary reader activity and contact with an Adobe host, so the file may simply be a legitimate tender document.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 61 antivirus engines that checked it flagged the file
- Sandbox runs showed only normal Adobe Acrobat activity
- Contacted hosts checked against our records showed no known-malicious entries
- Encrypted PDF delivered as an attachment, a format often used to hide content from scanners
- Name follows a common tender or secure-portal phishing lure
- First seen on Oct 26, 2026, with limited distribution
- The links inside the document were not examined
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 16sandbox rule tags
- 7spawned processes
- 4network contacts
- 32filesystem & mutex artifacts
Includes the sandbox verdicts, 16 mapped techniques, every process, file, registry and network entry and 7 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 244.1 kB
- Code signing
- Not applicable to this file type
- Last analyzed
- Oct 26, 2026, 10:54 AM UTC
- SHA-256
8a7f4310a78b271b3f14d6d8abd7b84060ae1adb84795564fec55448027fad9e- SHA-1
39f7eac2d3331f0e193f5f63a7138b566f836504- MD5
4d0c24e29ab52215694d7d14155b9f01
First scanned
Includes every engine result (75), 2 matched signature rules and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 5 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.