Scan report · 18 days agoPublic

op.lepiceriedestoits.com

103.153.182.184AS140947 · IN

Submittedhttps://op.lepiceriedestoits.com/kirby/

Landed onhttps://op.lepiceriedestoits.com/kirby/download.html· 1 redirect

Suspicious: page delivers an executable (https://op.lepiceriedes…com/kirby/download.php)

brand impersonation (Adobe, medium); execution instructions ("downloads folder")

Engine tags

Verdict

3 of 8 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 11.9 s · 8 requests

01 · Visitor opensop.lepiceriedestoits.com/kirby/

02 · Redirected · 1 hopSame host, another address/kirby/download.html

03 · Page shown

Background Image Pagestyled as Adobe · medium

04 · File delivered · maliciouskirby.exeop.lepiceriedestoits.comHanded over by the page, not served at the scanned address.

05 · OutcomeA program on the machineAn executable or installer was handed to the visitor under a pretext.

Dangerous — confirmed threat

Automated

Its page title claims to be Adobe, which this address is not associated with. It is listed on external threat-intelligence feeds. The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

MalwareMalware found in the downloaded file

kirby.exe

We analysed the file this page delivered — it is Malicious.

Success

SHA-256 d0d35fe06084bad98d0ceef8547d138ea5c5722a3e863db7665ca5b47e99f0e2

SupportingPage delivers an executable under a document pretext

https://op.lepiceriedestoits.com/kirby/download.php · brand impersonation (Adobe, medium); execution instructions ("downloads folder")

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

InfoBrand impersonation detected

Adobe · medium · logo shown, brand never named in the text

The page DISPLAYS a known brand's logo while carrying almost no content of its own — no article, no navigation, nothing the brand's own site would have.

Analyst noteThe brand is in the page's images, not just its words, and the page has nothing else on it. Check what the page is asking the visitor to do.

Files · 2

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileCleanThe engine stored it under a generated name

SHA-2569cc0dfa491f5eebdca6a351e699886946b0b96fdbcb7d454ea15af2fffdf6b93

Fromhxxps://op[.]lepiceriedestoits[.]com/kirby/

Delivered fileMaliciouskirby.exe

SHA-256d0d35fe06084bad98d0ceef8547d138ea5c5722a3e863db7665ca5b47e99f0e2

Fromhxxps://op[.]lepiceriedestoits[.]com/kirby/download[.]php

Infrastructure

IP: 103.153.182.184SNTHOSTINGS-AS-AP - SnTHostings, IN · AS140947IN
TLS: CN=YR1, O=Let's Encrypt, C=US · expires Nov 3, 2026
Redirects: 1 hop · /kirby/ → /kirby/download.html

WHOIS

Registrar: IONOS SE
Created: Jan 4, 2019
Expires: Jan 4, 2027
Nameservers: ns1036.ui-dns.dens1046.ui-dns.orgns1078.ui-dns.bizns1105.ui-dns.com

83 malicious26 suspicious

Hashes & fingerprints

Page Hash4584cde4678d996ecb1f7eb5cd10639187107edc60a9dcafa1ab867093e3455c DOM Hash809048cca3afc48fbeff3a5e5eb3d54a7f1c56bf7fe14883b2b60b80cd51b344 Screenshot pHashc3383cdec3c69638 JARM15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint1C6274A0542819AACEE6D5649E6EFB991912F9C2 Cert IssuerCN=YR1, O=Let's Encrypt, C=US

Page capture

Live

Title “Background Image Page” · brand shown: Adobe (medium)

Visit Site

Engines

8 · time to verdict