1

So I was about to install Battle.net Desktop App to play some World of Warcraft. Downloaded from the official Blizzard.com website. (https://www.blizzard.com/en-us/apps/battle.net/desktop)

Just out of curiousity I ran the .exe through Virustotal.com and expected it to be clean with a high community score (as it is a pretty popular software with millions of users).

However, when uploading the .exe it gets submitted as a unknown program, in other words as a .exe which has never been uploaded to Virustotal before. I shrugged and downloaded another copy of the same .exe with the same result.

Checking the sha256sum of each file shows that a new hash is generated for each download of the Battle.net app. Maybe some personal identifier gets injected in each download?

Also, none of the installers are signed according to Virustotal.com. "File not signed". However in Windows, when I right click on the installer -> Properties -> Digital Signature -> Information. It says: Digital signature OK".

This has never happened to me before. Could somebody help me verify this behaviour and possible give a reasonable explanation as to why this is happening with the Blizzard App?

Question 1. Why is a new hash being generated for each download of the .exe

Question 2: Why does Virustotal say it's not signed?

Improve this question
1
  • Have you uploaded the installer which is signed or the actual executable after installation (which doesn't seem to have a signature)? VirusTotal is not a virus scanner where you can scan your whole hard disk. Usually people only upload files they are unsure if it might be malicious or not. So I would expect that known to be benign executables are rarely uploaded to VT.
    – Robert
    Commented Apr 21, 2022 at 20:27

1 Answer 1

Reset to default
1

Most likely, Blizzard is indeed inserting some data into the downloaded EXE that differs each time. The reason is unclear - possibly some sort of analytics tracking, possibly something anti-piracy, possibly something else entirely - but that's enough to prevent any two downloads from being recognized as the same file.

As for why Windows says the file is signed anyhow, that's technically possible by signing each variant before it's downloaded, but more likely you've got something akin to what's happening in this question going on, where Windows AuthentiCode signatures don't actually depend on the entire file.

Why VirusTotal doesn't recognize the signature, I'm not sure. Perhaps they require a more-complete portion of the file be signed than Windows does (as mentioned in my answer to that question, AuthentiCode has multiple optional regions; Windows might allow some to be signed and some not, while other systems might require everything to be signed).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .