File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
This PDF document shows no antivirus detections across 76 engines, and the sandbox only saw Acrobat and Chrome activity typical of opening an ordinary e-book.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This document can be opened normally in an updated PDF reader. Keep reader updates and antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 63 flagged
- Flagged 0
- No detection 63
- No result 13
- Code signing Not applicable
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 63 antivirus engines that checked it flagged this PDF document, including every major antivirus engine. The sandbox only recorded the PDF reader, its helpers and a browser opening a reader promotion page. No malware-specific rules matched, and the file has been around for over four years without detections.
None of the 63 antivirus engines that checked it flagged this PDF, and all 18 major antivirus engines reported it clean. The sandbox process tree shows Acrobat, its crash and log helpers, and Chrome opening an Adobe promotional link, which is ordinary viewer behaviour. The network contacts fit reader and browser content-delivery traffic, although no complete host-reputation result is available. Embedded JavaScript and form features are common in e-book PDFs, and the only community rules that matched were generic.
What We Detected
0 of the 63 antivirus engines that checked it flagged this PDF document. No malware-specific YARA rules matched, and the file has no public malware-database listing. It was first seen more than four years ago.
Threat Behavior
In the sandbox runs, only Adobe Acrobat, its crash and log helpers, and Chrome opening an Adobe promotional page were recorded. No injection target and no persistence were observed. The few direct IP contacts are consistent with reader and browser traffic, but no complete host-reputation check is available. The document contains JavaScript and form features, which are common in PDFs.
What To Do Now
The file appears to be an ordinary document. Open it in an up-to-date PDF reader, and keep your antivirus protection enabled.
Where this verdict could be wrong1 caveat
- The document carries embedded JavaScript and an auto-action, which can be abused in malicious PDFs; our own static analysis of the bytes was not available to inspect them.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 63 antivirus engines that checked it flagged the file, including all major antivirus engines
- Sandbox activity was limited to the PDF reader and browser
- No malware-specific rules or malware-database listings matched
- Seen for more than four years without detections
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 24sandbox rule tags
- 15spawned processes
- 5network contacts
- 40filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
24MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1005
- T1012
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1070.004· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1203
- T1485
- T1486· File encryption
- T1548
- T1552· Credential search
- T1552.001· Credential search
- T1555· Password stealing
- T1555.003· Password stealing
- T1562· Disables security
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1566.002
- T1573
Observed activity
Processes started
15Programs the file ran, with their command lines.
Acrobat.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\<USER>\AppData\Local\Temp\PDF document"Adobe Crash Processor.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe"CRWindowsClientService.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" updatepvbpreference 2c4ad6bb-bfa1-4c1a-b2ba-4b87730af6f0 0 0CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\crashlogs"CRLogTransport.exe"C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe" "C:\Program Files\Adobe\Acrobat DC\Acrobat" "C:\Users\<USER>\AppData\LocalLow\Adobe\CRLogs\dumps"chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument https://www.adobe.com/go/reader-upsell-combine?mv=in-product&mv2=reader&invc=Edit_Megaverb_Tile&tl=combine-pdf&subtl=combine-tile&modern=true&SCAMode=Rdr&DTProd=Reader&DTServLvl=SignedOut&ttsrccat=RGS0313-ENU-Challenger1&AllToolsStateRetainPrefSet=false&installDate=20240215&firstLaunchDate=0&UpsellBucket=1
Show all 15 entries for processes started
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\<USER>\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.112 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb13b0dc40,0x7ffb13b0dc4c,0x7ffb13b0dc58chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1956,i,16191827088614916573,12207654823423537287,262144 --variations-seed-version=20240409-180046.183000 /prefetch:3chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=1956,i,16191827088614916573,12207654823423537287,262144 --variations-seed-version=20240409-180046.183000 /prefetch:8chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1956,i,16191827088614916573,12207654823423537287,262144 --variations-seed-version=20240409-180046.183000 /prefetch:8chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5020 --field-trial-handle=1956,i,16191827088614916573,12207654823423537287,262144 --variations-seed-version=20240409-180046.183000 /prefetch:8chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=64 --field-trial-handle=1956,i,16191827088614916573,12207654823423537287,262144 --variations-seed-version=20240409-180046.183000 /prefetch:8chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5460 --field-trial-handle=1956,i,16191827088614916573,12207654823423537287,262144 --variations-seed-version=20240409-180046.183000 /prefetch:8chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5384 --field-trial-handle=1956,i,16191827088614916573,12207654823423537287,262144 --variations-seed-version=20240409-180046.183000 /prefetch:8chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5468 --field-trial-handle=1956,i,16191827088614916573,12207654823423537287,262144 --variations-seed-version=20240409-180046.183000 /prefetch:8
Network contacts
55 hosts, listed as 5 addresses. Links show the host and path only.
- IP address
23.15.197.57 - IP address
173.194.215.84 - IP address
23.48.105.12 - IP address
2.21.41.101 - IP address
54.144.73.197
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst - Written
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst - Written
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\9.0\UserCache.bin - Written
C:\Users\<USER>\AppData\Local\Adobe\Updater6\AdobeUpdaterPrefs.dat - Written
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll - Written
C:\Users\user\AppData\LocalLow
Show all 30 entries for files
- Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_2 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_3 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\index - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 - Written
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Deleted
C:\Windows\Installer\MSI8C86.tmp - Deleted
C:\Windows\Installer\MSI94F4.tmp - Deleted
C:\Windows\Installer\MSI9581.tmp - Deleted
C:\Windows\Installer\MSI95E0.tmp - Deleted
C:\Windows\Installer\MSI965E.tmp - Deleted
C:\Windows\Installer\MSI972A.tmp - Deleted
C:\Windows\Installer\MSI97F6.tmp - Deleted
C:\Windows\Installer\MSI99AD.tmp - Deleted
C:\Windows\Installer\MSI9A89.tmp - Deleted
C:\Windows\Installer\MSI9B16.tmp - Deleted
C:\Windows\Installer\MSI9C8E.tmp - Deleted
C:\Windows\Installer\MSI9D0C.tmp - Deleted
C:\Windows\Installer\MSI9D6B.tmp - Deleted
C:\Windows\Installer\MSI9DE9.tmp - Deleted
C:\Windows\Installer\inprogressinstallinfo.ipi
Registry and auto-start
8Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_LOCAL_MACHINE\COMPONENTS\PendingXmlIdentifier - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cAcrobatUpsellTracking\tTrackingParam - Deleted
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer\ProductInfoCache - Deleted
HKEY_LOCAL_MACHINE\COMPONENTS\RepairTransactionPended - Deleted
HKEY_LOCAL_MACHINE\COMPONENTS\ExecutionState - Deleted
HKEY_LOCAL_MACHINE\COMPONENTS\PendingRequired
Show all 8 entries for registry and auto-start
- Deleted
HKEY_LOCAL_MACHINE\COMPONENTS\PoqexecFailure - Deleted
HKLM\System\Acrobatviewercpp304
Mutexes
10Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Acrobat Instance MutexGlobal\_MSIExecuteGlobal\MSILOG_206e3b1e1daab79GOL.20201ISM_pmeT_lacoL_ataDppA_onurB_sresU_:CGlobal\AdobeCrashProcessorLocalLowLockLocal\ZonesCacheCounterMutexLocal\ZonesLockedCacheCounterMutex
Show all 10 entries for mutexes
Global\WdsSetupLogInitGlobal\SetupLog2AC1A572DB6944B0A65C38C4140AF2F4824749E310CAcrobat Instance Mutex
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM host
204.79.197.203 - VM host
239.255.255.250 - VM host
224.0.0.251
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- ec2ff4d9abd96a9e42e0…b1e653Not checkedno saved verdict
- b161e8aabe5d37ca23a7…0c475dNot checkedno saved verdict
- 3bc0a711bad2516e489a…a313f1Not checkedno saved verdict
- 93cc885076bdeec36712…8b2967Not checkedno saved verdict
- 6aa8144364894f0dc214…e3f87dNot checkedno saved verdict
- c18c69dec133c5ec2972…e028b1Not checkedno saved verdict
- 14c0cb93ee60c4404dae…892f6cNot checkedno saved verdict
- 8567697985ac1571a38d…2a2d01Not checkedno saved verdict
- f738f48cc840cf157b91…de558eNot checkedno saved verdict
- e9e4adfa160ce9bbeda6…13b7b6Not checkedno saved verdict
Chapter 04
Technical details
None of the 63 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 3.8 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Aug 24, 2026, 3:51 PM UTC
- SHA-256
d357bfb033dfbe70c13def8d08997e5abaa941ce97e19ad0d066352bbc0dacfc- SHA-1
ed92d0ee00233564dba25bf19faa3761389f6928- MD5
4ef9efabbe94bfe47d445211a94c075f
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 63 engines flagged this file
13 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust12 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeClean
- McAfeeDNo result
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
- adonunix2generic
- vmdetectgeneric
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.