The only way to determine that is to open a case with TAC to track the conviction of this specific file. There are several reasons why a file is "unknown" for a period of time before being convicted. It might be seconds, minutes or days before the file is uploaded by a customer to the Threatgrid sandbox or convicted by some other means. Until we can get our hands on the file or it is convicted by a trusted third party it will remain unknown. There's no way to tell the history for this specific pdf from the event posted.
