Suspicious
Suspect

1a7b8067a07b5018301db094243b74ae

Share on LinkedIn
Print
PE Executable
MD5: 1a7b8067a07b5018301db094243b74ae
Size: 10.21 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 1a7b8067a07b5018301db094243b74ae
Sha1 7c48a2c529bd24fbc655479a1a35784f0da73071
Sha256 d576924be257246a25de90a655f4ffe5f33caedb093b8b6c2f2c7f6f6719a6a5
Sha384 44b7ab7e480a1026dcaa73782d431b8c54c77255143fac3329a2ac4b7e645587a8b69ed78944c03c422e43ea1a0826fc
Sha512 1c07376f8da18bbd1de0e4b4ff256c370836b6c6dc25f4179a306f6907a3bc2e5f021e1c1dd4decaf95e77a117602069af987ec6bb7d140f9bef76a74babbced
SSDeep 196608:hlJrCwKM6owKM62ZwKM6lJOEytEYoKaFfPtTOqc:hPkW27eEKaBP
TLSH 1EA69C1123FD8629F2FB7F70A9B85259CA77BCA6AE39D24E0655109E0D71B80CD60733
PeID
HQR data fileMicrosoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL
1a7b8067a07b5018301db094243b74ae
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
ID:0007
ID:0
ID:0-preview.png
ID:0008
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
app.ico
app-icon.png
app-icon.png-preview.png
luna-banner.jpeg
luna-banner.jpeg-preview.png
gas-station.png
gas-station.png-preview.png
browser.png
browser.png-preview.png
discord.png
discord.png-preview.png
kofi-logo.png
kofi-logo.png-preview.png
crypto-usdt.png
crypto-usdt.png-preview.png
theme-moon.png
theme-moon.png-preview.png
theme-sun.png
theme-sun.png-preview.png
teleport-location-saved.mp3
bundled-webview2-core.dll
[Authenticode]_455883b9.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
bundled-webview2-winforms.dll
.Net Resources
Microsoft.Web.WebView2.WinForms.Microsoft.Web.WebView2.WinForm.WebView2.bmp
[Authenticode]_70004349.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
bundled-webview2-loader.dll
[Authenticode]_fab9a4ac.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.tls
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Connection.png
Connection.png-preview.png
features (1).png
features (1).png-preview.png
Autoshow.png
Autoshow.png-preview.png
database (1).png
database (1).png-preview.png
self-driving.png
self-driving.png-preview.png
service_846355.png
service_846355.png-preview.png
photo-mode.png
photo-mode.png-preview.png
role-play.png
role-play.png-preview.png
car-maintenance.png
car-maintenance.png-preview.png
teleport (1).png
teleport (1).png-preview.png
consoel.png
consoel.png-preview.png
file.png
file.png-preview.png
Tutorial 2.png
Tutorial 2.png-preview.png
bug.png
bug.png-preview.png
setting.png
setting.png-preview.png
donate.png
donate.png-preview.png
Credit.png
Credit.png-preview.png
steam-icon.png
steam-icon.png-preview.png
xbox-icon.png
xbox-icon.png-preview.png
premade-teleport-all-xp-boards-ken.txt
premade-teleport-all-mascots-ken.txt
premade-teleport-all-houses-ken.txt
premade-teleport-all-photo-list-ken.txt
premade-teleport-discover-japan-ken.txt
premade-teleport-all-legends-xp-boards-patch.txt
premade-teleport-all-barn-finds-patch.txt
premade-teleport-all-treasure-cars-patch.txt
premade-driving-grip-stability-ken.txt
premade-driving-instant-launch.txt
premade-driving-chaos-preset-ken.txt
premade-driving-chaos-mode-ken.txt
Shina Profile Picture.png
Shina Profile Picture.png-preview.png
forza mods profile.gif
forza mods profile.gif-preview.png
Defualt.png
Defualt.png-preview.png
Matkhl Profile Picture.png
Matkhl Profile Picture.png-preview.png
Ariza Profile Picture.png
Ariza Profile Picture.png-preview.png
Ken Profile Picture.png
Ken Profile Picture.png-preview.png
Patchy Profile Picture.png
Patchy Profile Picture.png-preview.png
Merika Profile Picture.png
Merika Profile Picture.png-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

6 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 2
Name Value
Module Name
Forza Horizon Luna Open Source.exe
Full Name
Forza Horizon Luna Open Source.exe
EntryPoint
System.Void ForzaHorizon6AutoshowUnlocker.Program::Main()
Scope Name
Forza Horizon Luna Open Source.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Forza Horizon Luna Open Source
Assembly Version
1.5.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Info
PE Detect: PeReader OK (file layout)
Total Strings
51126
Main Method
System.Void ForzaHorizon6AutoshowUnlocker.Program::Main()
Main IL Instruction Count
30
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Boolean ForzaHorizon6AutoshowUnlocker.Native::IsAdministrator()
brtrue.s IL_0054: call System.Void ForzaHorizon6AutoshowUnlocker.Program::InstallBundledWebView2Runtime()
call System.String System.Windows.Forms.Application::get_ExecutablePath()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.0 <null>
ldloc.0 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.0 <null>
call System.String System.Windows.Forms.Application::get_ExecutablePath()
call System.String System.IO.Path::GetDirectoryName(System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0068: ret
pop <null>
ldstr Administrator rights are needed to attach to the running game process.
ldstr Forza Horizon 6 Luna
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
leave.s IL_0054: call System.Void ForzaHorizon6AutoshowUnlocker.Program::InstallBundledWebView2Runtime()
call System.Void ForzaHorizon6AutoshowUnlocker.Program::InstallBundledWebView2Runtime()
call System.Void ForzaHorizon6AutoshowUnlocker.Native::EnableDebugPrivilege()
newobj System.Void ForzaHorizon6AutoshowUnlocker.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙