Scan report · 4 days agoPublic

get-acrobat-adobe.pages.dev

188.114.96.1AS13335 · US

Submittedhttps://get-acrobat-adobe.pages.dev/

page delivers an executable (https://www.dropbox.com…c7627&st=a1zvnr65&dl=1)

brand impersonation (Adobe, medium); delivers a script, not an installer ("DOCUMENT_PDF.vbs"); presented as "Reader_en_R9BVLF8K_install.exe", delivers "DOCUMENT_PDF.vbs"

Engine tags

Verdict

2 of 9 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 8.9 s · 5 requests

01 · Visitor opensget-acrobat-adobe.pages.dev

02 · Page shown

Adobe Acrobat Readerstyled as Adobe · medium

03 · File delivered · maliciousDOCUMENT_PDF.vbswww.dropbox.comHanded over by the page, not served at the scanned address.

04 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

Its page title claims to be Adobe, which this address is not associated with. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

DOCUMENT_PDF.vbs

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 5a042d26d35888fb4aa16160716f4bd30627fdbcde42a57297703efd0aa4514e

SupportingPage delivers an executable under a document pretext

https://www.dropbox.com/scl/fi/1codp1duzvwf4pqxvl0u9/DOCUMENT_PDF.vbs?rlkey=ktq24aalp5hgjnklwyuuc7627&st=a1zvnr65&dl=1 · brand impersonation (Adobe, medium); delivers a script, not an installer ("DOCUMENT_PDF.vbs"); presented as "Reader_en_R9BVLF8K_install.exe", delivers "DOCUMENT_PDF.vbs"

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

Adobe · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileMaliciousDOCUMENT_PDF.vbs

SHA-2565a042d26d35888fb4aa16160716f4bd30627fdbcde42a57297703efd0aa4514e

Fromhxxps://www[.]dropbox[.]com/scl/fi/1codp1duzvwf4pqxvl0u9/DOCUMENT_PDF[.]vbs?rlkey=ktq24aalp5hgjnklwyuuc7627&st=a1zvnr65&dl=1

Infrastructure

IP: 188.114.96.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Dec 27, 2026

62 malicious13 suspicious

Hashes & fingerprints

Page Hash577270336f4a751e88ddd9a75d3cb396ede839400a2f8b543b1201e7f5644422 Favicon Hash838341cffd659542fc7048a4c5f9ddadc4427b4e81f73369b2ac604f8ea2262e DOM Hash45f62798eab65b9fa5655fb18c084881159a7ff4fe3a274ced5135c9160775b3 Screenshot pHashb89824c7c74ccec7 JARM27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint709C6F7237F8F66E99798A069030B4A3606E74EF Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Adobe Acrobat Reader” · brand shown: Adobe (medium)

Visit Site

Engines

9 · time to verdict