Foxit Reader and Foxit PhantomPDF is reported as Ransomware?

Hi Jason,

It may possibly be a false alert and to investigate further, Please help me with the questions below:

1. What is the OS on the computer that reports the alert? Are the other computers running the same OS?

2. What does the Foxit Reader and Foxit Phantom PDF do? do they just read the PDF files or modify them?

3. Also, what is the path of the infection?

In the meantime, you can submit the file to Sophos Labs for analysis. Please refer to this article Sophos Anti-Virus: "false positives" and "unwanted detections". Check the last topic in the given article "Submitting suspicious files, unwanted detections, and false positives". 

Thank you so much for your reply.

It only occurs in one of our computers which is Windows 10 Pro 64-bit.

Foxit Reader and Foxit PhantomPDF are applications for reading and editing PDF documents. You can get more info on their website: http://www.foxitsoftware.com

The path is the program folder, as following:

Hi Jason,

Sophos Endpoint is identifying Foxit Reader and Foxit PhantomPDF as Ransomware as they involve editing documents. Hence, you can exclude the application from scanning, please refer to this article How to: Exclude items from scanning or you can submit the sample as a False positive to Sophos Labs, please refer to this article Sophos Anti-Virus: "false positives" and "unwanted detections".

Hi Jason,

Sophos Endpoint is identifying Foxit Reader and Foxit PhantomPDF as Ransomware as they involve editing documents. Hence, you can exclude the application from scanning, please refer to this article How to: Exclude items from scanning or you can submit the sample as a False positive to Sophos Labs, please refer to this article Sophos Anti-Virus: "false positives" and "unwanted detections".

Hi, 

Thank you for your guidance. Thus as you mentioned 'as they involve editing documents', can I understand that any application which will edit document, such as Microsoft Word, Excel, will be treated as Ransomware?

Hi Jason,

The application is not considered as malware only with the feature of editing the documents, reputation of the application is also one of the reasons why it is identified as malware.

Foxit Reader and Foxit PhantomPDF are applications to read or edit PDF documents. It should be the same kind of application to Microsoft Word/Excel. 

Thus can I say that they are marked as Ransomware because their reputation is not high enough? If yes, I can contact Foxit to let them contact you to help resolve this. Thanks.