I've received PDF at work, which I then ran through virustotal scan out of habit. It turned out to be clean, but at the same time some tags caught my attention, namely:

  • checks-user-input
  • detect-debug-environment
  • direct-cpu-clock-access
  • long-sleeps
  • runtime-modules

These remain even after running it through ghostscript and then re-uploading them. Is such file safe to use?

1 Answer 1


While the probability might be low on getting all 5 tags at once, they probably are false positives if you don't see anything different than what you typically see in the task manager.

Usually depends on the file's size, but VirusTotal's tag system is based off of machine-learned data that is compared between thousands to millions of both benign and malware data. The data is acknowledged on each file and compared with each other to find similarities and differences to find a common ground between each other to come to a conclusion that is the tag file.

For example, if you tried to open the PDF file with the notepad, you'd see a bunch of gibberish and ascii characters that you don't recognize. VirusTotal takes notes of these kind of words and checks it with their machine learning system to generate tags related to the data of your file.

Your file could have just coincidentally have the tags that VirusTotal determined as "similar".

  • 1
    Honestly today i've checked several other PDFs i've had on HDD for quite a while and it seems common thing - most of them had these tags despite being a direct doc (created by me) to PDF conversions, so it seems like your explaination is on point, thanks
    – Fraymonix
    Nov 16, 2021 at 0:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .