File scan report
Verdict Safe
Is Black
This verified Pearl Abyss-signed Black Desert installer was flagged by none of the 70 antivirus engines that checked it and is widely submitted, and its sandbox run showed an…
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This installer can be used normally. Download future copies only from official Black Desert channels and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Pearl Abyss Corp.
- Test run Completed
- First seen 7mo ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
It has been seen from over 100 sources for months. In the sandbox it installed the game launcher and patcher and contacted only Pearl Abyss and captcha services.
A valid Pearl Abyss Corp. signature matches the claimed product, and no brand conflict exists. The file is common and long-observed, and no external threat-intelligence source matched it. Its single sandbox run was clean and showed a normal Inno Setup installation that registered an uninstaller and started the game launcher. All 31 contacted hosts were checked against our URL reputation records with no malicious or suspicious hits. Technique mappings such as injection and file encryption have no supporting target or detection and fit patcher behaviour.
What We Detected
None of the 70 antivirus engines that checked it flagged this file. The code signature from Pearl Abyss Corp., developer of Black Desert, is verified. The file has been submitted by 105 distinct sources over 228 days, and no threat-intelligence feed or YARA rule matched it.
Threat Behavior
In one sandbox run, the installer unpacked through Inno Setup and wrote game files into C:\Pearlabyss\BlackDesert. It created a standard uninstall registry entry and launched the Black Desert launcher and patcher. Network contacts went to Pearl Abyss game and CDN domains and to hCaptcha, and all 31 checked hosts had no malicious or suspicious reputation. Automated technique mappings for injection and file modification named no injected process and are consistent with patching activity.
What To Do Now
The installer appears to be the official game installer. For future downloads, obtain it from the official Black Desert site or Steam, and keep your antivirus enabled during installation.
Where this verdict could be wrong2 caveats
- The sandbox mapped T1485/T1486 (data destruction/encryption) and injection techniques; these mappings commonly arise from installers and game patchers overwriting files and are unaccompanied by any detection or injected target.
- Pearl Abyss Corp. has no signer history in our records yet, so the signature has not been checked against prior samples from this publisher.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged the file
- Verified code signature from Pearl Abyss Corp., matching the Black Desert product
- Widely seen across more than 100 sources over several months
- The sandbox run was clean, with network contacts limited to Pearl Abyss services and hCaptcha
- All 31 contacted hosts were checked with no malicious or suspicious hits
- Automated behaviour mapping listed injection and file-encryption techniques, though no injected process or detection supports them
- This publisher has no prior signing history in our records
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 29sandbox rule tags
- 6spawned processes
- 23network contacts
- 36filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
29MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1070· Covers its tracks
- T1071· Application protocol
- T1074
- T1082· System recon
- T1083· Scans your files
- T1106
- T1112
- T1129· Loads modules
- T1134
- T1485
- T1486· File encryption
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1529
- T1539
- T1548
- T1553
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1573
- T1614
- T1614.001
Observed activity
Processes started
6Programs the file ran, with their command lines.
BlackDesert_Installer_NAEU.exe"C:\Users\<USER>\Desktop\BlackDesert_Installer_NAEU.exe"BlackDesert_Installer_NAEU.tmp"C:\Users\<USER>\AppData\Local\Temp\is-UF219.tmp\BlackDesert_Installer_NAEU.tmp" /SL5="$200E8,35858181,1095680,C:\Users\<USER>\Desktop\BlackDesert_Installer_NAEU.exe"REG"REG" ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1" /V "UninstallString" /T "REG_SZ" /D "\"C:\Pearlabyss\BlackDesert\unins000.exe"\" /FREG"REG" ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1" /V "QuietUninstallString" /T "REG_SZ" /D "\"C:\Pearlabyss\BlackDesert\unins000.exe /SILENT\"" /FBlackDesertLauncher.exe"C:\Pearlabyss\BlackDesert\BlackDesertLauncher.exe"BlackDesertPatcher32.paeC:\Pearlabyss\BlackDesert\BlackDesertPatcher32.pae
Network contacts
2323 hosts, listed as 12 domains, 11 addresses. Links show the host and path only.
- Domain
naeu-o-dn.playblackdesert.com - Domain
open-pers.pearlapis.com - Domain
launcher.naeu.playblackdesert.com - Domain
s1.pearlcdn.com - Domain
static.pearlcdn.com - Domain
palivewebcontents.blob.core.windows.net
Show all 23 entries for network contacts
- Domain
account.pearlabyss.com - Domain
js.hcaptcha.com - Domain
newassets.hcaptcha.com - Domain
a9d7a404.w.hcaptcha.com - Domain
api.hcaptcha.com - Domain
89c5501b.w.hcaptcha.com - IP address
23.53.127.101 - IP address
40.64.67.131 - IP address
45.223.17.187 - IP address
52.85.12.57 - IP address
23.53.127.105 - IP address
20.150.4.36 - IP address
104.19.230.21 - IP address
104.19.229.21 - IP address
104.18.13.205 - IP address
104.18.12.205 - IP address
23.53.127.108
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-UF219.tmp\BlackDesert_Installer_NAEU.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\is-IQ9R4.tmp\_isetup\_setup64.tmp - Written
C:\Pearlabyss\BlackDesert\BlackDesertLauncher.exe - Written
C:\Pearlabyss\BlackDesert\msvcp140.dll - Written
C:\Pearlabyss\BlackDesert\d3dcompiler_43.dll - Written
C:\Pearlabyss\BlackDesert\libGLESv2.dll
Show all 30 entries for files
- Written
C:\Pearlabyss\BlackDesert\d3dcompiler_47.dll - Written
C:\Pearlabyss\BlackDesert\expapply.dll - Written
C:\Pearlabyss\BlackDesert\steam_api.dll - Written
C:\Pearlabyss\BlackDesert\libcef.dll - Written
C:\Pearlabyss\BlackDesert\libEGL.dll - Written
C:\Pearlabyss\BlackDesert\msvcp100.dll - Written
C:\Pearlabyss\BlackDesert\msvcr100.dll - Written
C:\Pearlabyss\BlackDesert\PERS.exe - Written
C:\Pearlabyss\BlackDesert\vcruntime140.dll - Deleted
C:\Pearlabyss\BlackDesert\is-QMM11.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-BQQCR.tmp - Deleted
C:\Pearlabyss\BlackDesert\BlackDesertLauncher.exe - Deleted
C:\Pearlabyss\BlackDesert\is-BKTF5.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-61MUU.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-51H35.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-AT12H.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-Q6RIH.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-IKT2T.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-9JTM0.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-QK5RN.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-LTGNH.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-IROUP.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-S53GA.tmp - Deleted
C:\Pearlabyss\BlackDesert\is-837A6.tmp
Registry and auto-start
19Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\Inno Setup: Setup Version - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\Inno Setup: App Path - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\InstallLocation - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\Inno Setup: Icon Group
Show all 19 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\Inno Setup: User - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\Inno Setup: Selected Tasks - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\Inno Setup: Language - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\DisplayName - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\DisplayIcon - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\UninstallString - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\QuietUninstallString - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\DisplayVersion - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BlackDesert_NA_is1\Publisher - Deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD - Deleted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Owner - Deleted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence - Deleted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash
Mutexes
6Named locks a program uses so only one copy runs; malware families often reuse them.
Local\InternetShortcutMutexcversions.3.mGlobal\SyncRootManagerLocal\Mutexf01b4d95cf55d32a.automaticDestinations-msLocal\Mutex5f7b5f1e01b83767.automaticDestinations-msGlobal\OneSettingQueryMutex+compat+encapsulation
Sandbox background — not the file
18The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
Show all 18 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM host
bg.microsoft.map.fastly.net - VM host
windows.msn.com-ion.edgesuite.net - VM host
a1672.dscr.akamai.net - VM host
svc.ha-teams.office.com - VM host
teams-mrc-ww-perf.tm-4.office.com - VM host
assets.msn.com - VM host
assets.msn.com-ion.edgesuite.net - VM host
a1666.dscr.akamai.net - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- b2fa5d3d07eafdda2c57…9f96dfNot checkedno saved verdict
- 1428d5ada7a6199bbc2b…4e482aNot checkedno saved verdict
- 2f23182ec6f4889397ac…3a8a1cNot checkedno saved verdict
- 0242e4e8b24e78c50437…a7cf99Not checkedno saved verdict
- da51571017bb6cc0cd1a…098129Not checkedno saved verdict
- 8063bb304c4b37c8436e…29a496Not checkedno saved verdict
- 53e30da95938e5e56666…f2a2c8Not checkedno saved verdict
- bb6a54a7414519312130…389dd8Not checkedno saved verdict
- b5dd8c49bb13bf2abc1d…e17048Not checkedno saved verdict
- a2411921fb8466a8db33…dc58a6Not checkedno saved verdict
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by Pearl Abyss Corp..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 17, 2026, 3:54 PM UTC
- SHA-256
d7506f18ad97cb9b88a38cf80a8ffd20a0ffe9e764c2c0cab2d0d6ee8b4117d6- SHA-1
8c678ca3b4dd631d9fc91ff05ca0ca9733529e87- MD5
604790c8727e86373b5d8c54a1e8b1d0
About this file
BlackDesert_Installer_NAEU.exe is a Win32 EXE file of 37.0 MB.
- Type and size
- Win32 EXE · 37.0 MB
- Signer
- Pearl Abyss Corp.Valid code signature.
- First seen
- Mar 3, 2026On VirusTotal.
- Submitted by
- 105 distinct sources
- Packer
- None detected
- Entropy
- 6.65 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust16 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetNo result
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is BlackDesert_Installer_NAEU.exe safe?
What is BlackDesert_Installer_NAEU.exe?
How many antivirus engines detected BlackDesert_Installer_NAEU.exe?
Is BlackDesert_Installer_NAEU.exe digitally signed?
What is the SHA-256 hash of BlackDesert_Installer_NAEU.exe?
Is it safe to install BlackDesert_Installer_NAEU.exe?
How up to date is this analysis of BlackDesert_Installer_NAEU.exe?
Community
Member reviews and reports for this exact file hash.
