File scan report
Verdict Suspicious
Is Forza Horizon 6 Luna Version 1.
Four engines flagged the archive, and runtime mapped defense impairment, but generic labels and absent family corroboration leave the evidence materially mixed.
Read the whole reasonShow less
Why Suspicious? 4 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
4 of 64 flagged
- Flagged 4
- No detection 60
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The archive extracts and runs an embedded executable, and the test run mapped attempted security-control impairment. However, only 4 of the 64 antivirus engines that checked it flagged it, just one was major, and no strong malware-family, malicious-host, malicious-child, or researcher-rule corroboration was found.
Four of the 64 antivirus engines that checked it flagged the archive, representing four independent detections, but only Fortinet was major and its label was generic. The archive extracted and launched an embedded executable during the test run. That run mapped T1562.001, which can indicate attempted impairment or modification of security controls and is the strongest concern here. No sandbox run supplied a malicious verdict, and the observed host had no malicious or suspicious cache entry. The four extracted children have no saved verdicts, so their safety cannot be established. Overall, the behavioral concern outweighs a simple false-positive interpretation, while the lack of consensus prevents attribution to a specific malware family.
What We Detected
Four of the 64 antivirus engines that checked it flagged the RAR archive. Fortinet was the only major detector and used the generic label “PossibleThreat”; the other labels were generic or heuristic, with no strong agreement on a named family.
Threat Behavior
The archive extracted and launched an embedded executable. The test run mapped T1562.001, associated with impairing or modifying security defenses, and observed repeated update-check requests. The single distinct host observed was checked against the available reputation cache without a malicious or suspicious match. No persistence or process injection target was recorded, and the sandbox did not issue a malicious verdict.
What To Do Now
Do not run the archive on a production or personal system until the embedded executable and all extracted files receive separate analysis. Keep antivirus and security software enabled, and obtain the software only through an official, independently verified distribution channel.
Where this verdict could be wrong3 caveats
- Only 4 of the 64 antivirus engines that checked it flagged the archive, and 16 of 17 reporting major antivirus engines did not flag it.
- The completed sandbox run did not issue a malicious verdict, and no persistence indicators or process injection targets were recorded.
- The four extracted files it created lack saved verdicts, so their contents remain unresolved rather than established as harmless.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 4 of the 64 antivirus engines that checked it flagged the archive, with no strong major family consensus.
- The completed sandbox run did not issue a malicious verdict.
- The observed host had no malicious or suspicious match in the available reputation cache.
- No persistence indicators or process injection targets were recorded.
- Researcher-curated intelligence produced no malware-specific rule or family hit.
- The archive extracted and launched an embedded executable.
- Behavior in the test run included a technique associated with impairing or modifying security defenses.
- Four independent antivirus detections were present, including one from a major antivirus engine.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 4sandbox rule tags
- 3spawned processes
- 1network contact
- 5filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Checked whether it was running on a test computer.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 6: FileSeen in the test run
Forza Horizon 6 Luna Version 1.4.8.rar
1da88074fb5aaa16cdbc48e3e5176b8597634249861ac4eaf360df41c8b58c2d
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 6: ProcessSeen in the test run
unarchiver.exe
C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\Forza Horizon 6 Luna Version 1.4.8.rar"
Test run - Evidence 3 of 6: ProcessSeen in the test run
7za.exe
C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\gjpl24an.thk" "C:\Users\user\Desktop\Forza Horizon 6 Luna Version 1.4.8.rar"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 6: Written fileSeen in the test run
gjpl24an.thk
C:\Users\user\AppData\Local\Temp\gjpl24an.thk
Test run - Evidence 5 of 6: Written fileSeen in the test run
Forza Horizon 6 Luna Version 1.4.8.exe
C:\Users\user\AppData\Local\Temp\gjpl24an.thk\Forza Horizon 6 Luna Version 1.4.8.exe
Test run - +1 more recorded observation
- 1
Network
Hosts contacted
- Evidence 6 of 6: Contacted hostSeen in the test run
goluna.app
Contacted during the test run.
Test run
6 facts from the test run. See the full activity list.
Includes 4 mapped techniques, every process, file, registry and network entry and 4 dropped files.
Show the technical evidenceChapter 04
Technical details
4 of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 4
- Fortinet (major engine)PossibleThreat
- DeepInstinctMALICIOUS
- MaxSecureTrojan.Malware.8328611.susgen
- VBA32CIL.StupidPInvoker-1.Heur
File fingerprint
- Last analyzed
- Oct 9, 2026, 10:57 PM UTC
- SHA-256
1da88074fb5aaa16cdbc48e3e5176b8597634249861ac4eaf360df41c8b58c2d- SHA-1
16d7b5836d8d161d7205effedc71e1e1d2c2d6ac- MD5
6c254ff53461d5e5595a190db79e75a0
About this file
Forza Horizon 6 Luna Version 1.4.8.rar is an RAR file of 9.8 MB.
- Type and size
- RAR · 9.8 MB
- Signer
- Not applicable
- First seen
- Jul 6, 2026On VirusTotal.
- Submitted by
- 94 distinct sources
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Forza Horizon 6 Luna Version 1.4.8.rar safe, or is it malware?
What is Forza Horizon 6 Luna Version 1.4.8.rar?
How many antivirus engines detected Forza Horizon 6 Luna Version 1.4.8.rar?
I already downloaded and opened or extracted Forza Horizon 6 Luna Version 1.4.8.rar — what should I do?
What is the SHA-256 hash of Forza Horizon 6 Luna Version 1.4.8.rar?
How up to date is this analysis of Forza Horizon 6 Luna Version 1.4.8.rar?
Community
Member reviews and reports for this exact file hash.