File scan report
Verdict Safe
Is The Amazing Spider-
No engines detected a threat, and the file has extensive history, benign evidence from the test run, checked network destinations, and a Steam DRM wrapper.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 11y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it flagged the executable, including the major engines represented in the scan. It has been submitted by 1,189 sources since it was first seen on Jul 9, 2015, while sandbox observation found no malicious verdict, file it created, persistence, or high-risk technique.
None of the 70 antivirus engines that checked it flagged the file, and 70 engines produced results, including 18 major engines without a detection. Its long history across 1,189 submitters strongly supports an established software sample rather than a newly distributed threat. Observation from the test run found no malicious sandbox verdict, named injection target, persistence indicator, or dropped file. The observed destinations received no malicious or suspicious result when all 22 distinct hosts were checked. Although one behaviour rule interpreted the unsigned executable, encrypted code, and network access as a downloader-like pattern, the encrypted section is associated with Steam DRM and no follow-on malicious activity corroborates that concern.
What We Detected
None of the 70 antivirus engines that checked it flagged the executable, and 70 engines produced results. The file has a substantial history: 1,189 distinct sources submitted it 1,512 times after it was first seen on Jul 9, 2015.
Threat Behavior
Sandbox observation recorded no malicious verdict, file it created, persistence indicator, named injection target, or high-risk technique. The observed network destinations were fully checked, and none had a malicious or suspicious cached result. The encrypted section belongs to a recognized Steam DRM wrapper, so its high entropy does not independently indicate packing by malware.
What To Do Now
The evidence supports normal use if the file came from the expected game installation or an authorized distribution channel. Keep security software enabled and obtain another copy from the original platform if the file appeared unexpectedly or fails to run correctly.
Where this verdict could be wrong2 caveats
- The executable is unsigned, so there is no verified publisher identity.
- One behaviour rule associated the encrypted code and contact with g.bing.com with a possible downloader profile, although no subsequent payload, malicious host, or hostile runtime artefact corroborated that interpretation.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged the file.
- The file has been submitted by 1,189 distinct sources since it was first seen on Jul 9, 2015.
- Sandbox observation found no malicious verdict, file it created, persistence indicator, or named injection target.
- All 22 observed hosts were checked, with no malicious or suspicious result.
- The high-entropy section is associated with the recognized Steam DRM wrapper.
- The executable has no verified publisher signature.
- One behaviour rule associated its encrypted code and network access with a possible downloader pattern, but no malicious follow-on activity corroborated that concern.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 16sandbox rule tags
- 4spawned processes
- 12network contacts
- 2filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1016· Network recon
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1027.005· Obfuscated code
- T1047
- T1056· Keylogging
- T1056.001· Keylogging
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1564.003· Hides artifacts
- T1574.002· Execution hijack
- T1614.001
Observed activity
Processes started
4Programs the file ran, with their command lines.
5dd29afef77b39a5895a42559801cf669765954cf8e43f6382994863cc1a1af6.exe%SAMPLEPATH%\5dd29afef77b39a5895a42559801cf669765954cf8e43f6382994863cc1a1af6.exesoftware.exe"C:\Users\user\Desktop\software.exe" -installsoftware.exe"C:\Users\user\Desktop\software.exe" /installsoftware.exe"C:\Users\user\Desktop\software.exe" /load
Network contacts
1212 hosts, listed as 1 domain, 11 addresses. Links show the host and path only.
- Domain
g.bing.com - IP address
64.233.181.94 - IP address
23.39.23.59 - IP address
23.60.12.74 - IP address
104.125.89.159 - IP address
23.198.74.242
Show all 12 entries for network contacts
- IP address
23.60.12.114 - IP address
23.219.78.71 - IP address
20.96.153.111 - IP address
23.53.122.214 - IP address
23.197.238.105 - IP address
23.32.75.29
Files
2Files the file created, changed or deleted.
- Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.h - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Sandbox background — not the file
25The analysis machine's own processes and connections, recorded in every run.
- VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google3672_2056780215\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3748_172600292\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3792_2107413404\bin\updater.exe - VM process
updater.exeC:\Program Files\Google480_173455615\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3664_543453762\bin\updater.exe
Show all 25 entries for sandbox background — not the file
- VM process
updater.exeC:\Program Files\Google1532_584013551\bin\updater.exe - VM process
updater.exeC:\Program Files\Google2448_1092605109\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files\Google3672_2056780215\bin\updater.exe - VM injection target
C:\Program Files\Google3748_172600292\bin\updater.exe - VM injection target
C:\Program Files\Google3792_2107413404\bin\updater.exe - VM injection target
C:\Program Files\Google480_173455615\bin\updater.exe - VM host
res.public.onecdn.static.microsoft - VM host
www.microsoft.com - VM host
www.bing.com - VM host
20.99.186.246 - VM host
152.195.19.97 - VM host
52.154.209.174 - VM host
23.55.140.42 - VM host
20.99.185.48 - VM host
192.168.0.57 - VM host
20.99.133.109 - VM host
23.216.81.152 - VM host
a83f:8110:0:0:0:0:1400:0
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 4, 2026, 5:38 AM UTC
- SHA-256
5dd29afef77b39a5895a42559801cf669765954cf8e43f6382994863cc1a1af6- SHA-1
605c8774ddd7a628d4cfdfb38be62c97fc4b3362- MD5
96275511826a2e69f96242035658dd1d
About this file
The Amazing Spider-Man 2 (TM).exe is a Win32 EXE file of 6.3 MB.
- Claims to be
- The Amazing Spider-Man 2 (TM)From the file's own version information, written by whoever built it.
- Original name
- The Amazing Spider-Man 2 (TM).exeMatches the shared file name.
- Type and size
- Win32 EXE · 6.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 9, 2015On VirusTotal.
- Submitted by
- 1,189 distinct sources
- Packer
- Possibly packedPacking hides code; legitimate installers use it too.
- Entropy
- 6.43 of 8A code section is highly compressed or encrypted.
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is The Amazing Spider-Man 2 (TM).exe safe?
What is The Amazing Spider-Man 2 (TM).exe?
How many antivirus engines detected The Amazing Spider-Man 2 (TM).exe?
What is the SHA-256 hash of The Amazing Spider-Man 2 (TM).exe?
Is it safe to run The Amazing Spider-Man 2 (TM).exe?
How up to date is this analysis of The Amazing Spider-Man 2 (TM).exe?
Community
Member reviews and reports for this exact file hash.