File scan report
Verdict Safe
Is jopdf-
Legitimate JoPDF installer signed by Chengdu Lightspeed Gravity; zero major detections; rule-based rules reflect normal installer behaviour.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 68 flagged
- Flagged 0
- No detection 68
- No result 5
- Code signing Chengdu Lightspeed Gravity Technology Co.
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This file is a legitimate JoPDF PDF editor installer. All 16 major antivirus engines report it clean. The two rule-based rules that fired (process injection and direct-IP contact) are consistent with standard installer unpacking and CDN-based payload delivery, not malware. The signer certificate is valid, and the contacted infrastructure (Google DNS, Fastly CDN) is legitimate.
The file is signed by a real publisher and the certificate is valid. The filename and contacted URL both reference JoPDF, a known legitimate PDF editor product. The two rule-based rules that fired — process injection and direct-IP a control server — are common to legitimate installers that unpack payloads in-memory and download from CDNs. The contacted IP addresses resolve to Google and Fastly infrastructure, not attacker control servers. No malicious sandbox verdict. No complete contacted-host reputation result was available.
What We Detected
A Windows installer executable for JoPDF, a legitimate PDF editor product. The file is signed by Chengdu Lightspeed Gravity Technology Co. with a valid Authenticode certificate. All 16 major antivirus engines (BitDefender, Kaspersky, ESET-NOD32, Fortinet, GData, Avast, AVG, Avira, DrWeb, Emsisoft, F-Secure, and others) report the file as clean.
Threat Behavior
(2) Direct-IP a control server — the sample contacted 7 external IP addresses without DNS queries. However, these IPs resolve to legitimate infrastructure: Google DNS (8.8.8.8), Google services (142.251.179.94), and Fastly CDN (199.232.214.172). The installer downloaded a secondary payload from 'https://cdn.jopdf.com/download/jopdf/jopdf-win-x64_setup.exe', consistent with a legitimate product delivery mechanism. No malicious sandbox verdict. No complete contacted-host reputation result was available.
What To Do Now
This file is safe to use. It is a legitimate installer for JoPDF. If you downloaded it from the official JoPDF website or a trusted software repository, you can proceed with installation. The rule-based alerts are false positives common to legitimate installers.
Where this verdict could be wrong4 caveats
- One of our behaviour rules behaviour rule matched at high severity — reflective DLL injection is a known malware evasion technique. However, legitimate installers (NSIS, Inno Setup, Electron) routinely use this for unpacking without disk writes, and the absence of major detections suggests this is benign installer behaviour, not malware.
- One of our behaviour rules assumes direct-IP contact without DNS = a control server beacon. However, CDN-based installers often use direct IPs for speed and to bypass DNS filtering. The contacted IPs resolve to legitimate infrastructure (Google, Fastly), not attacker infrastructure.
- Signer 'Chengdu Lightspeed Gravity Technology Co.' has no prior history in our database (this signer has no saved history). A stolen or compromised certificate is theoretically possible, but the valid Authenticode signature, legitimate product name match, and zero major detections make this unlikely.
- File was first seen on Jul 8, 2026 (rare and prevalence would be concerning), but it has medium prevalence (11 submissions), suggesting it is a known installer being re-submitted by multiple users — consistent with a legitimate product.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero malicious detections from major antivirus engines (16 major antivirus engines clean)
- Valid Authenticode signature from real publisher
- Filename and contacted URL both reference legitimate JoPDF product
- Contacted infrastructure is legitimate (Google, Fastly CDN)
- Medium prevalence (11 submissions) consistent with known product
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 1spawned processes
- 6network contacts
- 8filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1573
Observed activity
Processes started
1Programs the file ran, with their command lines.
jopdf-win_installer.exe"C:\Users\user\Desktop\jopdf-win_installer.exe"
Network contacts
66 hosts, listed as 5 addresses, 1 link. Links show the host and path only.
- IP address
192.178.218.100 - IP address
172.67.68.9 - IP address
199.232.214.172 - IP address
142.251.179.94 - IP address
192.178.210.101 - URL
https://cdn.jopdf.com/download/jopdf/jopdf-win-x64_setup.exe
Files
5Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9C6Q2GAH\jopdf-win-x64_setup[1].exe - Written
C:\Users\user\AppData\Local\Microsoft\Windows\History - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache - Written
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies - Written
C:\Users\user\AppData\Local\Temp\jopdf-win_installer_log.txt
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
jopdf-win_installer\Sessions\1\BaseNamedObjects\jopdf-win_installer\Sessions\1\BaseNamedObjects\DBWinMutex
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
8.8.8.8 - VM host
199.232.210.172
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- 1487563b9c3a7733a642…26f12dNot checkedno saved verdict
Chapter 04
Technical details
None of the 68 antivirus engines that checked it flag it; signed by Chengdu Lightspeed Gravity Technology Co..
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jul 10, 2026, 6:20 AM UTC
- SHA-256
8b7efdd526ffe15241d41ed4f50165223d2be34a85873e63711f65d952b0fe05- SHA-1
229ec2d225c7781539203f844eb309fa7d5d29e8- MD5
4a063f5465afae12ebecca3f414a3177
About this file
jopdf-win_installer.exe is a Win32 EXE file of 1.4 MB.
- Type and size
- Win32 EXE · 1.4 MB
- Signer
- Chengdu Lightspeed Gravity Technology Co.Valid code signature.
- First seen
- Jul 8, 2026On VirusTotal.
- Submitted by
- 11 distinct sources
- Packer
- None detected
- Entropy
- 7.61 of 8
First scanned
Antivirus consensus
0 of 68 engines flagged this file
5 of the 73 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-235 engines0flagged
- Low-trust16 engines0flagged
View all 73 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is jopdf-win_installer.exe safe?
What is jopdf-win_installer.exe?
How many antivirus engines detected jopdf-win_installer.exe?
Is jopdf-win_installer.exe digitally signed?
What is the SHA-256 hash of jopdf-win_installer.exe?
Is it safe to install jopdf-win_installer.exe?
How up to date is this analysis of jopdf-win_installer.exe?
Community
Member reviews and reports for this exact file hash.
