File scan report
Verdict Safe
Is this PDF document safe? Yes, no threats found.
76 of the 61 antivirus engines that checked it report clean; sandbox shows normal Acrobat Reader activity.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Open the PDF with antivirus protection left enabled; no additional precautions needed.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 15
- Code signing Not applicable
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The PDF triggered no malicious detections across the antivirus engines. Sandbox execution inside Adobe Acrobat Reader produced only expected reader processes and CDN traffic.
Zero malicious engine detections and zero major flags establish a clean consensus. The single sandbox run shows the file opened inside legitimate Acrobat Reader DC, with network activity limited to Google DNS and Akamai edge IPs. Ten files it created were inspected and none flagged malicious. External intelligence sources returned no hits, and the file’s age and low submission count align with an academic textbook rather than malware.
What We Detected
76 engines scanned the 32 MB PDF; none returned a malicious or suspicious result. Sandbox execution produced only Acrobat Reader CEF processes and standard cache files.
Threat Behavior
Observed MITRE techniques map to normal PDF rendering and font caching. Contacted IPs belong to public DNS and CDN infrastructure, not known control servers.
What To Do Now
The file can be opened safely with current protections enabled. No further action is required.
- Zero malicious detections across 76 engines
- Sandbox behaviour matches legitimate Acrobat Reader
- No malicious files it created or external-intel hits
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 4sandbox rule tags
- 3spawned processes
- 2network contacts
- 35filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
4MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1036
- T1055.011· Process injection
- T1082· System recon
- T1083· Scans your files
Observed activity
Processes started
3Programs the file ran, with their command lines.
RdrCEF.exec:\program files (x86)\adobe\acrobat reader dc\reader\acrocef_1\RdrCEF.exe --backgroundcolor=16514043ProgramC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\PDF documentRdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
104.102.28.179 - IP address
3.219.243.226
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3040 - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3040 - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING - Written
Local\08B97F70 - Written
Local\0620CDC0
Show all 30 entries for files
- Written
Local\08BEA620 - Written
Local\08BEAA70 - Written
Local\08B80C88 - Written
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\UserCache.bin - Written
Local\08BEA1D0 - Written
Local\08B810D8 - Written
Local\0A5649A0 - Written
C:\Users\<USER>\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-231210234915Z-530.bmp - Written
Local\0A565690 - Deleted
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\DC_READER_LAUNCH_CARD - Deleted
C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\ACROBAT_READER_MASTER_SURFACEID - Deleted
C:\Users\<USER>\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal - Deleted
C:\Users\<USER>\AppData\Local\Temp\A979ejem_10e0rdw_2cg.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A95mtyg0_10e0rdx_2cg.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A913h9s9i_10e0re0_2cg.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A91w63uf6_10e0rdy_2cg.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A9lw839x_10e0rdz_2cg.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A91gt90cl_10e0re1_2cg.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\A918y7jqf_10e0re2_2cg.tmp - Deleted
C:\Users\<USER>\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 - Deleted
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_LOCAL_MACHINE\System\Acrobatviewercpp473
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Acrobat Instance MutexDBWinMutex\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex\Sessions\1\BaseNamedObjects\DBWinMutex\Sessions\1\BaseNamedObjects\com.adobe.acrobat.rna.RdrCefBrowserLock.DC
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
8.8.8.8
Files this sample writes at runtime
This file drops 7 children at runtime. None are currently flagged malicious in our cache. 7 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 42452982537c7c2b64cb…152290Not checkedno saved verdict
- c87eb145fdc6d3e59d48…3aa482Not checkedno saved verdict
- 0d98d7dae1b6936feed0…575f2aNot checkedno saved verdict
- f2b3e3659601b7994542…06a95fNot checkedno saved verdict
- 637d06de23cc8f9feb72…6cd482Not checkedno saved verdict
- ff06e38f3d807ad79ed5…ce4364Not checkedno saved verdict
- 0968477fe2b0ad304dca…af7084Not checkedno saved verdict
Chapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- File name
- PDF document
- Format
- Size
- 32.6 MB
- Code signing
- Not applicable to this file type
- Last analyzed
- Sep 1, 2026, 12:11 PM UTC
- SHA-256
e168b5ba1350ada53dfc9a2310a037e0c9847c03a3800d07b076eb1c120c9dc1- SHA-1
976936c2dea9098ceb2b4d540de1dac90c795a80- MD5
d5b76f53813dd5b32ddcb361ada0c137
First scanned
Antivirus consensus
0 of 61 engines flagged this file
15 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust10 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BitDefenderThetaClean
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeNo result
- CybereasonNo result
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FireEyeClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MAXClean
- MaxSecureClean
- McAfeeClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055.011 (sandbox MITRE mapping)
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is this PDF document safe?
What is this PDF document?
How many antivirus engines detected this PDF document?
What is the SHA-256 hash of this PDF document?
Is it safe to open this PDF document?
How up to date is this analysis of this PDF document?
Community
Member reviews and reports for this exact file hash.