Safe
Blizzard-signed Battle.net installer with 17 tier-1 engines clean; single low-trust generic detection is a false positive.
de5d32d4ea5eed5a9e…7f0b87fcafThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits the signed commercial false-positive shape: verified signature from a curated trusted publisher (Blizzard), zero tier-1 malicious detections, only one low-trust generic heuristic flag, no malicious sandbox verdict, no malicious children, and no malicious contacted hosts. The 409 submissions from 306 unique sources in 10 days reflect a widely distributed, recently released installer. The DirectIpC2 heuristic fired because the sample contacted 7 IPs without DNS queries, but those IPs resolve to legitimate Blizzard services (battle.net, telemetry-in.battle.net), not external C2. Installers routinely contact their vendor's infrastructure directly for telemetry and updates.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.tier1Malicious=0; 17 tier-1 engines (Avast, BitDefender, Kaspersky, ESET, Fortinet, etc.) all clean
signing.verified=true, trustedPublisher.matched=true for Blizzard Entertainment (curated publisher)
1/70 malicious detection is Webroot (low-trust) with generic label 'W32.Malware.gen'; no family consensus
prevalence.classification='common_new' — 306 submitters, 409 submissions in 10 days (legitimate distribution pattern)
Contacted IPs resolve to battle.net and telemetry-in.battle.net (legitimate Blizzard infrastructure, not malicious C2)
- Signed by Blizzard Entertainment (curated trusted publisher)
- 17 tier-1 antivirus engines report clean
- Contacted IPs resolve to legitimate Blizzard infrastructure
- High prevalence (409 submissions, 306 unique sources) in 10 days
- No malicious sandbox verdict, no malicious children, no malicious contacted hosts
This file is safe. It is the official Battle.net installer from Blizzard Entertainment. The single low-trust detection is a false positive; no action is required.
1 contradiction resolved by the scoring engine
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 52.202.132.189
- 137.221.105.136
- 8.8.8.8
- 54.156.112.159
- 137.221.104.171
- 137.221.105.232
- 162.159.36.2
- http://nydus.battle.net/geoip
- https://telemetry-in.battle.net/data
- C:\ProgramData\Battle.net\Setup\bna_2\Logs\battle.net-setup-20260611T040441.log
- C:\ProgramData\Battle.net\Setup\bna_2\Logs\battle.net-setup-20260607T233920.log
- C:\ProgramData\Battle.net
- C:\ProgramData\Battle.net\Setup
- C:\ProgramData\Battle.net\Setup\bna_2
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache.
- 8d806babfccfe5574d79…233a20Never scannednever seen before
- f363a5b849f95f5726a8…77e27aNever scannednever seen before
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 7 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence52.202.132.189 · 137.221.105.136 · 8.8.8.8
1 detection across 74 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Forensic fingerprint
- File name
- Battle.net-Setup.exe
- Size
- 4.67 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- de5d32d4ea5eed5a9e120027fb68b370976dbfecc8f2a8f91305977f0b87fcaf
- MD5
- b789a6f741f6391b5c6dd227b1693db5
- SHA-1
- af4985fdc59f40c8313457911c073ee122d72339
- PE imphash
- 79dbe573912bfd2d08a3c01a29dfeaed
- First seen (VT)
- 6/10/2026, 5:03:59 PM
- Last analysis (VT)
- 6/20/2026, 5:55:04 AM
- First scan (MalwareTips)
- 6/20/2026, 8:00:20 PM
- Last scan (MalwareTips)
- 6/20/2026, 8:00:20 PM
- Code signer
- Blizzard Entertainmentverified
- Community reputation
- +1trusted
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.