Skip to main content
C
carl_6924
Participant
September 28, 2024
Question

Is this PDF file up to no good?

  • September 28, 2024
  • 2 replies
  • 4473 views

I recieved a PDF file a while back that I believe to be malicious.  I'm wondering if anyone could tell me what SOPHIA means when it comes to Adobe.  This is one of the files that the PDF writes.

 

C:\Users\<USER>\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json

 

There is a lot more to this file, but this is the only thing i'm asking about right now.

 

Is this a normal file?

    2 replies

    R
    Adobe Employee
    ravinderg62643219
    Adobe Employee
    October 21, 2024

    Hi @carl_6924 

     

    This is a json file downloaded by Reader for some of its internal functioning. Are you facing any issue due to this file?

     

    Regards

    Ravi

      M
      Matthew26951389gufy
      Participant
      September 21, 2025

      This is triggering threat detection and malware warnings in VirusTotal and whilst trying to upload PDFs to GoogleDrive.... which isn't a great user experience for Adobe Customers.

      try67
      Community Expert
      try67Community Expert
      Community Expert
      September 29, 2024

      This is not a PDF file, but a JSON file, which can contain data and code, which can be (in theory) malicious. But unless you share the file with us there's really no way to say for sure. And SOPHIA doesn't mean anything in the Adobe-world, as far as I know. It's just the name of the file/folder.

        M
        m_8223
        Participant
        October 1, 2024

        Hi,

         

        I have a similar issue too. Here is the thing the file (or folder SOPHIA) has been created by Adobe Acrobat. On some computers, the file does not exist. The problem I have is similar to this isssue https://www.reddit.com/r/techsupport/comments/z7mozw/stealth_malware_keeps_destroying_wifibluetooth/   when I use virustotal with some random pdf files (in different sizes) I get similar results. Some of the results are flagged as "Mitre" I am not sure whether it is legit or not. However, the file do not exists on some pc of my friends. I deleted the folder and it is created automatically when I open a pdf.

        ls_rbls
        Community Expert
        ls_rblsCommunity Expert
        Community Expert
        September 23, 2025

        @m_8223  , 

         

        Most interesting ==> "Mitre"

        Terms & ConditionsAccessibility statement
        Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices