Report - 45.145.42.103:1911/MicrosoftEdgeWebview2Setup.exe

Report Overview

Visitedpublic

2025-01-11 04:57:20

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP	Fingerprints
45.145.42.103	unknown	unknown	No data	No data	419 B	1.8 MB	45.145.42.103

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-01-11 04:56:54	medium	Client IP	45.145.42.103	ET INFO Executable Download from dotted-quad Host
2025-01-11 04:56:54	high	45.145.42.103	Client IP	ET POLICY PE EXE or DLL Windows file download HTTP
2025-01-11 04:56:54	medium	45.145.42.103	Client IP	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2025-01-11	medium	45.145.42.103:1911/MicrosoftEdgeWebview2Setup.exe	Detect pe file that no import table

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-01-11	medium	45.145.42.103	Sinkholed

ThreatFox

No alerts detected

File detected

URL

45.145.42.103:1911/MicrosoftEdgeWebview2Setup.exe

IP / ASN

45.145.42.103

#58212 dataforest GmbH

File Overview

File TypePE32 executable (GUI) Intel 80386, for MS Windows, 7 sections

Size1.8 MB (1839718 bytes)

MD5123772b779efeb991810828a4d91def9

SHA13ee9a03280751f38b2ef9e9f1416480b1b4ecfe2

SHA25667f31983e4fd6dbd4f8c1d46064c151c117a0f64cc39b999c0a432130834c3ae

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect pe file that no import table

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

GET 45.145.42.103:1911/MicrosoftEdgeWebview2Setup.exe

45.145.42.103

200 OK

1.8 MB

URL

45.145.42.103:1911/MicrosoftEdgeWebview2Setup.exe

IP / ASN

45.145.42.103

#58212 dataforest GmbH

Requested byN/A

Resource Info

File typePE32 executable (GUI) Intel 80386, for MS Windows, 7 sections

First Seen2025-01-11

Last Seen2025-01-11

Times Seen1

Size1.8 MB (1839718 bytes)

MD5123772b779efeb991810828a4d91def9

SHA13ee9a03280751f38b2ef9e9f1416480b1b4ecfe2

SHA25667f31983e4fd6dbd4f8c1d46064c151c117a0f64cc39b999c0a432130834c3ae

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect pe file that no import table
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /MicrosoftEdgeWebview2Setup.exe HTTP/1.1
Host: 45.145.42.103:1911
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Transfer-Encoding: chunked
Server: Microsoft-HTTPAPI/2.0
Date: Sat, 11 Jan 2025 04:56:54 GMT