pdfinstalls-2.vercel.app
64.29.17.195AS16509 · USSuspicious: page delivers an executable (https://pub-6c532f29d3c…rn6YCAWJ9P4p2Licum.exe)
- Delivered filemalicious
- Browser Analysissuspicious
- Threat Intelligenceclean
- Network & Hostingclean
- Content Inspectionclean
- Related Infrastructureclean
- TLS Fingerprintunknown
- Domain Intelligenceunknown
- +1 more below
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
ConfirmedIts page title claims to be Adobe, which this address is not associated with. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
Findings
Strongest firstWe analysed the file this page delivered — it is Malicious.
Success
SHA-256 7c9826bd66e3acaf4b2442c8ae5b391fdec3318cbc7fa8030ca32674d66af075
The page's own script names an executable installer hosted on a different domain, rather than offering it as an ordinary download link.
Analyst noteThe URL was read from an inline script, so it is what the page INTENDS to deliver — a download may not have been observed. Check who operates the instance in the URL, and treat a remote-access tool offered by an unrelated lure page as a compromise attempt.
The page presents itself as a document but its button downloads a program to run, not a document to read.
Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.
The page DISPLAYS a known brand's logo while carrying almost no content of its own — no article, no navigation, nothing the brand's own site would have.
Analyst noteThe brand is in the page's images, not just its words, and the page has nothing else on it. Check what the page is asking the visitor to do.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileMaliciousinstall-T7PBrn6YCAWJ9P4p2Licum.exe
SHA-2567c9826bd66e3acaf4b2442c8ae5b391fdec3318cbc7fa8030ca32674d66af075
Fromhxxps://pub-6c532f29d3c34c6a910620ee29dd906a[.]r2[.]dev/install-T7PBrn6YCAWJ9P4p2Licum[.]exe
Infrastructure
- IP
- 64.29.17.195AMAZON-02 - Amazon.com, Inc., US · AS16509US
- TLS
- CN=WR1, O=Google Trust Services, C=US · expires Nov 27, 2026
Hashes & fingerprints
Reviewed by—
Page capture
LiveTitle “PDF Viewer” · brand shown: Adobe (medium)
Engines
9 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- PDF Viewer
- Load
- 9.04 s · 12 requests