PBE Security Analysis Report
Disposition
Recommended action: No CAPE indicators were found after filtering. Release is reasonable if the source matches user expectation.
This disposition is based on the v0.2 scoring model calibrated against benign Microsoft binaries. It is informational, not a guarantee.
Drafted for the requester. Adjust greeting/closing as needed.
Thanks for checking with us on CIF.pdf before you opened it.
IT ran the file in our analysis sandbox for 3 minute(s) and 49 seconds. Our analysis rated this at 0.40 out of 10, which we classify as Clean (high confidence). During the analysis, the file launched 1 process(es), contacted 62 network indicator(s), did not drop any files to disk, triggered indicators of concern (exploit_heapspray).
Based on what we observed, this file is reasonable to open if it came from a source you recognize and expected.
Please continue to forward anything you are unsure about. Catching it before you open is exactly the right move.
PBE IT Security
| STRONG signatures | 1 signature(s), contributed 0.4 |
|---|---|
| UNBACKED family (capped at 2.0) | raw=0.0, applied=0.0 |
| AMBIGUOUS re-amplification | 0 signature(s), contributed 0.0 (only fires when 2+ STRONG present) |
| UNKNOWN signatures (half weight) | contributed 0.0 |
| Detection floor applied? | no |
| Final v0.2 Score | 0.40 / 10 |
| Signature | Sev | Weight | Conf | Score Δ | Description |
|---|---|---|---|---|---|
exploit_heapspray | 1 | 1.0 | 40.0% | 0.4 | A possible heap spray exploit has been detected |
No ambiguous signatures.
No unbacked signatures.
No unknown signatures.
| Signature | Sev | Weight | Conf | Score Δ | Description |
|---|---|---|---|---|---|
stealth_network | 1 | 1.0 | 100.0% | 0.0 | Network activity detected but not expressed in monitor API logs |
antidebug_setunhandledexceptionfilter | 1 | 1.0 | 40.0% | 0.0 | SetUnhandledExceptionFilter detected (possible anti-debug) |
No shell_host signatures.
| File name | CIF.pdf |
|---|---|
| File type | PDF document, version 1.6 (zip deflate encoded) |
| Size (bytes) | 2102589 |
| MD5 | 86a300b8128761d4f6f5b495fa078926 |
| SHA1 | 625ef8744189934d038c841ed47b2a282c12849f |
| SHA256 | ea6539eecfc0f7142d058261177b071541d859f024c6ad4574aa16a18333730c |
| VirusTotal | Open in VirusTotal |
| Task ID | 57 |
|---|---|
| Started | 2026-08-13 11:58:14 |
| Ended | 2026-08-13 12:02:03 |
| Duration (sec) | 229 |
| Package | |
| Route | internet |
| Machine | cuckoo1 |
No override active. The model verdict above is the current classification.
Report generated on 08-13-2026 12:03:02 by PBESANDBOX.PBESECURE.COM
