File scan report
Verdict Low Risk
Is this PDF document safe? Not fully confirmed.
No engine flags this encrypted PDF and sandbox runs looked normal, but its tender-portal style name fits common phishing lures and its links were never examined.
Read the whole reasonShow less
Why not Safe? We could not confirm who made it.
Limited evidence · Nothing points to a problem, but little confirms who made it.
Verify with the sender through a separate, known channel before trusting this document. Never enter credentials on a site opened from a link inside it.
Good practice3 tips
Low Risk: no threat found, but we could not fully confirm this file.
Get it from the publisher's own website or app store, not from a re-upload or a link someone sent you.
Keep your security software on, and stop if the file does anything you didn't expect.
It is less than a day old. If you're unsure, scan it again in a few days; antivirus engines often catch up on new files.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen Today
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 61 antivirus engines that checked it flagged this PDF document, and four sandbox runs showed only normal Adobe Acrobat activity. However, it is an encrypted e-mail attachment first seen on Oct 26, 2026, with a name typical of document-portal phishing. Nobody has inspected the links it contains, so its safety cannot be confirmed.
None of the 61 antivirus engines that checked it flagged the file, including all 18 major antivirus engines. The four sandbox runs opened it in Acrobat and recorded only the reader's own helper processes and a connection to an Adobe host, with no injection or credential access. The mapped process-injection and credential-dumping techniques had no supporting artefact and are routine on clean documents. Even so, phishing PDFs usually work through a link to a fake login page, which engines and sandboxes rarely catch. This file is encrypted, was sent as an attachment and uses a tender-portal style name, and its links were not examined. No reference database or wide distribution vouches for it either.
What We Detected
None of the 61 antivirus engines that checked it flagged this PDF document. It carries encrypted and attachment tags, was first seen on Oct 26, 2026, and has been submitted by nine sources. No malware database or community rule lists it.
Threat Behavior
Four sandbox runs opened the document in Adobe Acrobat. They observed only the reader, its crash and log helpers, and a connection to an Adobe service host. No process injection or credential access was recorded. The document's name fits the shared tender or 'secure portal' lure common in phishing campaigns. Its embedded links were not inspected, so a credential-phishing link cannot be ruled out.
What To Do Now
If you received this file unexpectedly, confirm with the sender through a known contact method before opening it. Do not enter any login details on a page reached from a link inside the document.
Where this verdict could be wrong1 caveat
- The sandbox opened the document in Acrobat and saw only ordinary reader activity and contact with an Adobe host, so the file may simply be a legitimate tender document.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 61 antivirus engines that checked it flagged the file
- Sandbox runs showed only normal Adobe Acrobat activity
- Contacted hosts checked against our records showed no known-malicious entries
- Encrypted PDF delivered as an attachment, a format often used to hide content from scanners
- Name follows a common tender or secure-portal phishing lure
- First seen on Oct 26, 2026, with limited distribution
- The links inside the document were not examined
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 16sandbox rule tags
- 7spawned processes
- 4network contacts
- 32filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1012
- T1027· Obfuscated code
- T1033· Reads user info
- T1047
- T1055· Process injection
- T1069
- T1071· Application protocol
- T1082· System recon
- T1089
- T1203
- T1485
- T1497· Sandbox evasion
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1574· Execution hijack
Observed activity
Processes started
7Programs the file ran, with their command lines.
Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\Desktop\PDF document"Adobe Crash Processor.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"CRWindowsClientService.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference 654c4eb7-098c-4cfa-a8a2-caca73e9d172 0 0CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"RdrCEF.exec:\program files (x86)\adobe\acrobat reader dc\reader\acrocef_1\RdrCEF.exe --backgroundcolor=16514043
Show all 7 entries for processes started
Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\PDF document"
Network contacts
44 hosts, listed as 1 domain, 2 addresses, 3 links. Links show the host and path only.
- Domain
acroipm2.adobe.com - IP address
199.232.214.172 - IP address
150.171.110.195 - URL
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl - URL
http://crl.microsoft.com/pki/crl/products/WinPCA.crl - URL
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
Files
26Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\acroNGLLog.txt - Written
C:\Users\<USER>\AppData\Local\Temp\NGL\ - Written
C:\Users\<USER>\AppData\Local\Temp\Tmp9EDB.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\TmpA10E.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\A9fthj9l_1so0eul_3yo.tmp - Written
C:\Windows\System32\wbem\repository\WRITABLE.TST
Show all 26 entries for files
- Written
C:\Windows\System32\wbem\repository\MAPPING1.MAP - Written
C:\Windows\System32\wbem\repository\MAPPING2.MAP - Written
C:\Windows\System32\wbem\repository\MAPPING3.MAP - Written
C:\Windows\System32\wbem\repository\OBJECTS.DATA - Written
C:\Windows\System32\wbem\repository\INDEX.BTR - Written
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3864 - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Deleted
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\DC_READER_LAUNCH_CARD - Deleted
C:\Users\<USER>\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal - Deleted
C:\Users\<USER>\AppData\Local\Temp\Cab231.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\Tar232.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\Cab20F.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\Tar220.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A92yy60p_ni1o4o_2zc.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A96bw0n1_ni1o4p_2zc.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A914uh8v0_ni1o4q_2zc.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9bz80st_ni1o4r_2zc.tmp
Registry and auto-start
19Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@%systemroot%\system32\wsdapi.dll,-200 - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@C:\Windows\System32\AppxPackaging.dll,-1001 - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@%SystemRoot%\System32\SessEnv.dll,-101 - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-304 - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\7b\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-305 - Set
Software\Adobe\Acrobat Reader\DC\ExitSection\bLastExitNormal
Show all 19 entries for registry and auto-start
- Set
Software\Adobe\Adobe Acrobat\DC\DiskCabs\bForms_AdhocWorkflowBackup - Set
Software\Adobe\Adobe Acrobat\DC\DiskCabs\bJSCache_GlobData - Set
Software\Adobe\Adobe Acrobat\DC\DiskCabs\bJSCache_GlobSettings - Set
SOFTWARE\Adobe\Acrobat Reader\DC\DLLInjection\bBlockDLLInjection - Set
Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable - Set
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings - Set
{2D60541F-00CD-4C84-83DE-0E14AC57578A}\WpadDecisionReason - Set
{2D60541F-00CD-4C84-83DE-0E14AC57578A}\WpadDecisionTime - Set
{2D60541F-00CD-4C84-83DE-0E14AC57578A}\WpadDecision - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cAcrobatUpsellTracking\tTrackingParam - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer\ProductInfoCache - Deleted
HKEY_LOCAL_MACHINE\System\Acrobatviewercpp473 - Deleted
HKEY_LOCAL_MACHINE\SYSTEM\Acrobatbrokerserverdispatchercpp789
Mutexes
6Named locks a program uses so only one copy runs; malware families often reuse them.
Global\_MSIExecuteGlobal\MSILOG_545c59fc1dd652bGOL.477b1ISM_pmeT_lacoL_ataDppA_onurB_sresU_:CGlobal\AdobeCrashProcessorLocalLowLock\Sessions\1\BaseNamedObjects\{100184D2-BDC3-477a-B8D3-65548B67914C}_6888\Sessions\1\BaseNamedObjects\Local\{100184D2-BDC3-477a-B8D3-65548B67914C}_6980\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 7 entries for sandbox background — not the file
- VM host
8.8.8.8
Files this sample writes at runtime
This file drops 7 children at runtime. None are currently flagged malicious in our cache. 7 have no saved verdict and were not checked; that is missing coverage, not a finding.
- c51e383cf440abd9a772…ae09bbNot checkedno saved verdict
- 13540c92104065fe9515…a824f2Not checkedno saved verdict
- f2c78f6abdbc5f18fda7…9d3af2Not checkedno saved verdict
- a5c6d4dbae668479ccb9…11631bNot checkedno saved verdict
- 4df98d996551189e28df…fe1f0dNot checkedno saved verdict
- aeb4d4eaf64889cb277f…d4a5dbNot checkedno saved verdict
- 1f2719b100fcc59601f0…4a0ed0Not checkedno saved verdict
Chapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 244.1 kB
- Code signing
- Not applicable to this file type
- Last analyzed
- Oct 26, 2026, 10:54 AM UTC
- SHA-256
8a7f4310a78b271b3f14d6d8abd7b84060ae1adb84795564fec55448027fad9e- SHA-1
39f7eac2d3331f0e193f5f63a7138b566f836504- MD5
4d0c24e29ab52215694d7d14155b9f01
First scanned
Antivirus consensus
0 of 61 engines flagged this file
14 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-231 engines0flagged
- Low-trust12 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXNo result
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 5 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.