Acrobat Distiller appears on both legitimate first-generation output and downstream re-save flows — context (the other tool on the same document) is what flips the signal.
Back to all statisticsForensic verdictBased on 303 appearances across the HTPBE? corpus.
Corpus profile
Acrobat Distiller is Adobe’s long-standing PostScript-to-PDF converter, historically used in print prepress and corporate publishing pipelines that emit PostScript before normalizing to PDF. It still ships inside Acrobat Pro.
Distiller appears on legitimately-produced corporate documents and print-shop output. We see it most often as the original Producer with no downstream re-saver on the same file. Low signal in tampered corpus when it sits alone.
Role in the workflow
Every PDF carries a Creator (the application that produced the original document) and a Producer (the engine that wrote the PDF). The same tool can appear in either slot, with very different modification profiles.
Name fingerprints
Different version strings and spellings observed for Acrobat Distiller in the wild. All are merged into the same canonical profile.
Why variants matter
The same tool publishes itself under 13 different metadata strings — version bumps, locale tags, build IDs. We canonicalize them so the corpus reflects one identity, not noise.
Distributions
The PDF versions Acrobat Distiller writes when acting as Producer, and the other tools that appear in the same documents.
Most output is PDF 1.6 (54% of files where Acrobat Distiller is the Producer).
PScript5 sits upstream in 93% of cases — read this row as “what kinds of documents end up routed through Acrobat Distiller.”
Related profiles
Other tools that frequently share metadata with Acrobat Distiller in the same documents. Each card links to its own forensic profile.
Long tail
Smaller cuts of the Acrobat Distiller corpus — useful context, but treat each row as a single data point rather than a strong signal.
Create your account — API key on signup, free test environment on every plan.
From $15/mo. No sales call. Cancel any time.