Also wondering about this
I had Claude Opus 5.5 with reverse-engineer-anything take a look at the executable and got this:
Opus 5.5 output
I found nothing malicious in it. It's an ordinary indie game, and the risk looks low. Everything below comes from reading the file. I never ran it.
What it is. Hamburger Hill.exe is a game made with the Godot game engine, version 4.7.2, with all the game's data built into the one 393 MB file. Windows' download tag shows you got it from the internet as hamburger-hill-0.7.0-windows.zip. It isn't digitally signed, which is normal for small indie games but means nothing proves who made it.
What I checked:
- Game code: I decoded all 408 of the game's script files and searched them for anything that could cause harm. None of them:
- run other programs or commands (no PowerShell or cmd)
- open websites or file folders on their own
- connect to the internet, or contain any web addresses
- read your environment variables or system folders
- load extra code packs or plugins at runtime
- File access: the game only touches its own save folder. It writes its settings, campaign saves, screenshots and a config file there. The two places that delete files are on the new-campaign and campaign-result screens, which fits clearing an old save.
- Bundled files: the 15,796 files inside are ordinary game content: textures, sounds, maps, scenes and shaders. There are no extra DLLs or hidden programs, and nothing is encrypted or disguised.
- Startup: nothing is set to run automatically when the game starts besides the main game scene. The one plugin listed is a well-known open-source level-editor tool (func_godot), which only does anything inside the Godot editor.
- Engine part: it identifies itself as 4.7.2.stable.official. It has the usual structure of a Godot game exported with its data built in, and it only uses the standard Windows system libraries.
What I couldn't confirm:
- I didn't compare the engine part byte-for-byte against Godot's official 4.7.2 release, so a modified engine can't be ruled out completely. Nothing suggested one, though.
- Checking file contents doesn't tell you who made it. If you got it from the developer's own itch.io, Steam or GitHub page, that plus these results is reassuring. If it came from a random re-upload, be more careful.
- I didn't run it, so I haven't seen what it does in practice.
Recommendation: It's reasonable to run. For extra reassurance, you can search for its SHA-256 fingerprint on VirusTotal or check it against the developer's download page:
CA562A347D964740BC471DE9930011EDC37F5F55E81065B6285D18F2E0AC0968
Windows SmartScreen will probably warn you on first launch because the file is unsigned and rarely downloaded. That warning is expected here.
✻ Baked for 2m 42s
It's a false positive.