1a7b8067a07b5018301db094243b74ae

PE Executable

MD5: 1a7b8067a07b5018301db094243b74ae

Size: 10.21 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	1a7b8067a07b5018301db094243b74ae
Sha1	7c48a2c529bd24fbc655479a1a35784f0da73071
Sha256	d576924be257246a25de90a655f4ffe5f33caedb093b8b6c2f2c7f6f6719a6a5
Sha384	44b7ab7e480a1026dcaa73782d431b8c54c77255143fac3329a2ac4b7e645587a8b69ed78944c03c422e43ea1a0826fc
Sha512	1c07376f8da18bbd1de0e4b4ff256c370836b6c6dc25f4179a306f6907a3bc2e5f021e1c1dd4decaf95e77a117602069af987ec6bb7d140f9bef76a74babbced
SSDeep	196608:hlJrCwKM6owKM62ZwKM6lJOEytEYoKaFfPtTOqc:hPkW27eEKaBP
TLSH	1EA69C1123FD8629F2FB7F70A9B85259CA77BCA6AE39D24E0655109E0D71B80CD60733

PeID

HQR data fileMicrosoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL

STICH beta

No STICH Path has been generated for this analysis yet.

6 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 2

Name	Value
Module Name	Forza Horizon Luna Open Source.exe
Full Name	Forza Horizon Luna Open Source.exe
EntryPoint	System.Void ForzaHorizon6AutoshowUnlocker.Program::Main()
Scope Name	Forza Horizon Luna Open Source.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Forza Horizon Luna Open Source
Assembly Version	1.5.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Info	PE Detect: PeReader OK (file layout)
Total Strings	51126
Main Method	System.Void ForzaHorizon6AutoshowUnlocker.Program::Main()
Main IL Instruction Count	30
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Boolean ForzaHorizon6AutoshowUnlocker.Native::IsAdministrator() brtrue.s IL_0054: call System.Void ForzaHorizon6AutoshowUnlocker.Program::InstallBundledWebView2Runtime() call System.String System.Windows.Forms.Application::get_ExecutablePath() newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.0 <null> ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> call System.String System.Windows.Forms.Application::get_ExecutablePath() call System.String System.IO.Path::GetDirectoryName(System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> leave.s IL_0068: ret pop <null> ldstr Administrator rights are needed to attach to the running game process. ldstr Forza Horizon 6 Luna call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> leave.s IL_0054: call System.Void ForzaHorizon6AutoshowUnlocker.Program::InstallBundledWebView2Runtime() call System.Void ForzaHorizon6AutoshowUnlocker.Program::InstallBundledWebView2Runtime() call System.Void ForzaHorizon6AutoshowUnlocker.Native::EnableDebugPrivilege() newobj System.Void ForzaHorizon6AutoshowUnlocker.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.