File scan report
Verdict Suspicious
Is PDF_
A disk image named like a PDF that contains an embedded executable, flagged by 3 of the 42 antivirus engines that checked it including Symantec, and submitted by a single source.
Read the whole reasonShow less
Why Suspicious? 3 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Do not mount or open this disk image. Confirm with the sender through another channel, and delete the file if you did not expect it.
What to do now5 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
It is less than a day old. If you're unsure, scan it again in a few days; antivirus engines often catch up on new files.
If you already opened it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
3 of 42 flagged
- Flagged 3
- No detection 39
- No result 33
- Code signing Not applicable
- Test run Not run
- First seen Today
Chapter 02
Why we think so
4 points against it and 2 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This virtual disk image is named like a PDF document, yet our static analysis found an executable inside it. Three of the 42 antivirus engines that checked it flag it with generic trojan labels, Symantec among them. It was first seen on Oct 27, 2026 and has only one submitter. We have no observation from the test run of what it does.
Three of the 42 antivirus engines that checked it flagged the file, which amounts to two votes because MicroWorld-eScan and VIPRE share one scan engine. One of the three is the major Symantec engine. None of the labels names a real malware family. Our static analysis found indicators of an embedded Windows executable inside a disk image whose name suggests a PDF. Disguising a program as a document inside a mountable disk image is a known way to deliver malware. The file is rare, with a single submission, and no sandbox or host-reputation evidence is available to confirm or rule out harmful behaviour.
What We Detected
3 of the 42 antivirus engines that checked it flagged this virtual disk image (VHD). Symantec reports a generic malicious-code label, and MicroWorld-eScan and VIPRE, which share one engine, report a generic trojan label. Our static analysis found indicators of an embedded executable, although the file name presents it as a PDF document.
Threat Behavior
No sandbox run is available, so we observed no behaviour in the test run. Mounting a disk image like this exposes the program inside it, and that program could be launched in place of the expected document. The file was first seen on Oct 27, 2026 from a single source.
What To Do Now
Do not mount the disk image or run anything inside it. If you expected a PDF from the sender, confirm with them through a separate channel. If you already opened it, scan your system with up-to-date security software.
Where this verdict could be wrong2 caveats
- The engine labels are generic rule-based buckets with no named family, and 11 major antivirus engines that returned a result did not flag the file.
- Our static analysis fired no static rule and found no decisive pattern. The embedded-executable matches are generic indicators that legitimate disk images also produce.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Most engines that returned a result, including 11 major antivirus engines, did not flag it
- No listing in public malware databases or matches from community malware rules
- A disk image named like a PDF document contains an embedded executable
- Symantec and one other independent engine flag it with trojan labels
- Rare file seen from a single submitter
- No observation from the test run is available to rule out harmful behaviour
7 sources checked · 5 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
3 of the 42 antivirus engines that checked it flag it.
No risky structure found
We opened the uploaded file in an isolated sandbox and read its structure without running it.
26 links found. Only domains are shown; paths and query strings are never published.
Checked on Oct 27, 2026 while the file was uploaded. MalwareTips deleted its copy afterwards; VirusTotal keeps the uploaded file.
Sources checked
Every check behind this verdict
7 sources checked · 5 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 3
- Symantec (major engine)Scr.Malcode!gen43
- MicroWorld-eScanTrojan.GenericKDZ.121053
- VIPRETrojan.GenericKDZ.121053
File fingerprint
- Last analyzed
- Oct 27, 2026, 7:16 AM UTC
- SHA-256
dddc0d0e21bffccbdc998b6aa6459169fdef68b3e6019dd977390764c7c7b5b9- SHA-1
3618b75a46356ee1cf85658dc42fd2b10dfe0d70- MD5
945dbb77027e8f1e57b6459931e7b66b
About this file
PDF_GV2JGE_[number][1].vhd is an unknown file of 8.4 MB.
- Type and size
- unknown · 8.4 MB
- Signer
- Not applicable
- First seen
- Oct 27, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is PDF_GV2JGE_[number][1].vhd safe, or is it malware?
What is PDF_GV2JGE_[number][1].vhd?
How many antivirus engines detected PDF_GV2JGE_[number][1].vhd?
I already downloaded and opened PDF_GV2JGE_[number][1].vhd — what should I do?
What is the SHA-256 hash of PDF_GV2JGE_[number][1].vhd?
How up to date is this analysis of PDF_GV2JGE_[number][1].vhd?
Community
Member reviews and reports for this exact file hash.