Post by champpp in Hamburger Hill comments

Viewing post in Hamburger Hill comments

Hi! I'm interested in playing Hamburger Hill and downloaded the latest version directly from your itch.io page.

Before running it, I checked the EXE on VirusTotal, and 2 out of 69 security vendors flagged it:

Gridinsoft: Trojan.Heur!.02252823
Trapmine: Malicious.moderate.ml.score

The SHA-256 hash of the file is: ca562a347d964740bc471de9930011edc37f5f55e81065b6285d18f2e0ac0968

I know these detections could be false positives, but Windows Defender SmartScreen also warns that the publisher is unknown.

Could you please confirm whether you're aware of these detections and whether you've verified that the latest Windows build is safe to run?

Thanks for making the game!

Gregghy17 days ago(+2)

I know these detections could be false positives, but Windows Defender SmartScreen also warns that the publisher is unknown.
--
regarding the publisher unknown, is because you have to pay a fee to microsoft to buy they certificate in order to become a "known developer".
I wont say anything regarding virus scanning or other thing.

Wesware16 days ago(+1)

Thanks for sharing this! Those detections look like false positives. My game contains no intentionally malicious code, and the “unknown publisher” warning is expected because I haven’t digitally signed the Windows build. I haven’t verified your exact file yet, but I appreciate you sharing the hash and flagging this!

agrippamaxentius16 days ago(+1)

Hey Wesware! Thanks for responding to the antivirus concerns.

I recently featured Hamburger Hill on my YouTube channel and really enjoyed playing it!

I did notice the two VirusTotal detections mentioned above, although both Avast and a completed Microsoft Defender Full Scan came back clean on my computer.

I understand these are likely false positives, but I wanted to ask whether you've had a chance to verify the latest Windows executable, particularly the SHA-256 hash shared above.

Based on your investigation, can you confirm whether the current download is safe to run and play?

Thanks again for your work on the game. I really enjoyed it and would love to continue playing with peace of mind!

zaxxofficial14 days ago

Also wondering about this

Islewolf13 days ago

I had Claude Opus 5.5 with reverse-engineer-anything take a look at the executable and got this:

Opus 5.5 output

I found nothing malicious in it. It's an ordinary indie game, and the risk looks low. Everything below comes from reading the file. I never ran it.

What it is. Hamburger Hill.exe is a game made with the Godot game engine, version 4.7.2, with all the game's data built into the one 393 MB file. Windows' download tag shows you got it from the internet as hamburger-hill-0.7.0-windows.zip. It isn't digitally signed, which is normal for small indie games but means nothing proves who made it.

What I checked:

- Game code: I decoded all 408 of the game's script files and searched them for anything that could cause harm. None of them:

- run other programs or commands (no PowerShell or cmd)

- open websites or file folders on their own

- connect to the internet, or contain any web addresses

- read your environment variables or system folders

- load extra code packs or plugins at runtime

- File access: the game only touches its own save folder. It writes its settings, campaign saves, screenshots and a config file there. The two places that delete files are on the new-campaign and campaign-result screens, which fits clearing an old save.

- Bundled files: the 15,796 files inside are ordinary game content: textures, sounds, maps, scenes and shaders. There are no extra DLLs or hidden programs, and nothing is encrypted or disguised.

- Startup: nothing is set to run automatically when the game starts besides the main game scene. The one plugin listed is a well-known open-source level-editor tool (func_godot), which only does anything inside the Godot editor.

- Engine part: it identifies itself as 4.7.2.stable.official. It has the usual structure of a Godot game exported with its data built in, and it only uses the standard Windows system libraries.

What I couldn't confirm:

- I didn't compare the engine part byte-for-byte against Godot's official 4.7.2 release, so a modified engine can't be ruled out completely. Nothing suggested one, though.

- Checking file contents doesn't tell you who made it. If you got it from the developer's own itch.io, Steam or GitHub page, that plus these results is reassuring. If it came from a random re-upload, be more careful.

- I didn't run it, so I haven't seen what it does in practice.

Recommendation: It's reasonable to run. For extra reassurance, you can search for its SHA-256 fingerprint on VirusTotal or check it against the developer's download page:

CA562A347D964740BC471DE9930011EDC37F5F55E81065B6285D18F2E0AC0968

Windows SmartScreen will probably warn you on first launch because the file is unsigned and rarely downloaded. That warning is expected here.

✻ Baked for 2m 42s

It's a false positive.

zaxxofficial1 day ago

Thank you!