Scan report · 17 days agoPublic

jskmarketings.com

104.21.73.31AS13335 · US

Submittedhttps://jskmarketings.com/acknowledgment.html

page delivers an executable (https://jskmarketings.c…etup-jskmarketings.iso)

brand impersonation (Adobe, medium); document pretext ("e-sign"); content suppressed for non-Windows visitors; execution instructions ("double-click")

Engine tags

Verdict

3 of 8 enginesMaliciousAutomated

Own this site?

Dangerous — confirmed threat

Automated

Its page title claims to be Adobe, which this address is not associated with. It is listed on external threat-intelligence feeds. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

What happened

Step by step, from what the scanner recorded.

Load 11.2 s · 16 requests

01 · Visitor opensjskmarketings.com/acknowledgment.html

02 · Page shown

Adobe Acrobat Reader DCstyled as Adobe · medium

03 · File delivered · maliciousAcrobatSetup-jskmarketings.isojskmarketings.comHanded over by the page, not served at the scanned address.

04 · Sent on towww.google.com

05 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Findings

Strongest first

MalwareMalware found in the downloaded file

AcrobatSetup-jskmarketings.iso

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 f367768387fc1deea2ea904aed28e7017d40dd4e17f5c12a4e56bce9005101b5

Inside · 3 files

helper.exeMaliciousPE File
SHA-256a5a861bbae68bc966088f3260aae74487775be4b0732ca5292592cc7bdd9e052
MSEDGEUPDATE.MSIMaliciousGeneric File
SHA-256e3a7429edaefb398143fbe6eed31815d48d13b4cd704a7b232121c4c589ab6a6
AcrobatSetup.exeCleanPE File
SHA-256f260ac3b6793c46e1efdf7ad3d7149d277bd78ea68d45900a9e7992f1d52b3de

StrongCAPTCHA-gated cloaked redirector

google.com

The page put a human-verification challenge (Turnstile/reCAPTCHA/hCaptcha) in front of a redirect that leaves for a different domain. Automated analysis can't clear the challenge, so the redirect target was read from the page's own script instead. The challenge here is cloaking, not site security.

Analyst noteThe redirect target is the real landing — pivot on it. A legitimate site does not hide a cross-domain redirect behind a CAPTCHA it embedded itself. Especially strong when the carrier is object storage, the target is http, or affiliate/TDS params ride the URL.

SupportingPage delivers an executable under a document pretext

https://jskmarketings.com/property-files/AcrobatSetup-jskmarketings.iso · brand impersonation (Adobe, medium); document pretext ("e-sign"); content suppressed for non-Windows visitors; execution instructions ("double-click")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

Adobe · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

InfoCross-domain scripts injected at runtime

1 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Delivered fileMaliciousAcrobatSetup-jskmarketings.iso

SHA-256f367768387fc1deea2ea904aed28e7017d40dd4e17f5c12a4e56bce9005101b5

Fromhxxps://jskmarketings[.]com/property-files/AcrobatSetup-jskmarketings[.]iso

Inside · 3 files

helper.exeMaliciousPE File
SHA-256a5a861bbae68bc966088f3260aae74487775be4b0732ca5292592cc7bdd9e052
MSEDGEUPDATE.MSIMaliciousGeneric File
SHA-256e3a7429edaefb398143fbe6eed31815d48d13b4cd704a7b232121c4c589ab6a6
AcrobatSetup.exeCleanPE File
SHA-256f260ac3b6793c46e1efdf7ad3d7149d277bd78ea68d45900a9e7992f1d52b3de

Infrastructure

IP: 104.21.73.31CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Dec 2, 2026

WHOIS

Registrar: Tucows Domains Inc.
Created: Jul 21, 2026
Expires: Jul 21, 2027
Nameservers: dimitris.ns.cloudflare.compat.ns.cloudflare.com

Related scans · 64

Hashes & fingerprints

Page Hasha553de637742816ae06e63909303e8781217a65575d4bf4a15ef4cf413e2c882 Favicon Hashab7224802f89f7f51720201d59db9268ff4077c4eb129745d764eef4de7f383b DOM Hash9c92e120f9cc7f8818d73342e4d523cb322cff4dd3559cb6511c8d85944a3e1c Screenshot pHashed23928c6d3396cc JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintA730E6198F9C66EC565113F6D205A73EF25D2018 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Adobe Acrobat Reader DC” · brand shown: Adobe (medium)

Visit Site

Engines

8 · time to verdict