Virustotal 17 security vendors and 1 sandbox flagged this file as malicious

[askvpb]

Virustotal indicated the .exe file 17 security vendors and 1 sandbox flagged this file as malicious. Is this false positive?
https://www.virustotal.com/gui/file/9475f529d96d306d52d050cf816712894fc082da863b733cae22f9dbd3b433bd

[hasturo]

I guess it is because it opens and depack files and compare the result to a List of File Hashes.

[hillu]

I guess it is because it opens and depack files and compare the result to a List of File Hashes.

Actually no. Even after stripping the binary down to

package main

import (
	"fmt"
	"os"
)

func main() {
	if len(os.Args) < 2 {
		fmt.Printf("Usage: %s [ paths ... ]\n", os.Args[0])
		os.Exit(1)
	}
}

it still gets flagged by multiple engines, including Microsoft's.

This is beyond embarrassing for the AV industry.

[askvpb]

I guess it is because it opens and depack files and compare the result to a List of File Hashes.

Actually no. Even after stripping the binary down to

package main

import (
	"fmt"
	"os"
)

func main() {
	if len(os.Args) < 2 {
		fmt.Printf("Usage: %s [ paths ... ]\n", os.Args[0])
		os.Exit(1)
	}
}

it still gets flagged by multiple engines, including Microsoft's.

This is beyond embarrassing for the AV industry.

Looks like move AV vendors are reporting the exe files as malware. Cannot use the script on the server with AV installed, unless doing some tampering with configurations. Would appreciate if this can be reported as a false positive?

[hillu]

Cannot use the script on the server with AV installed, unless doing some tampering with configurations. Would appreciate if this can be reported as a false positive?

Tell me where to report it and I'll try when I find time.

[simonai1254]

You can do this here for Microsoft:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives?view=o365-worldwide#part-4-submit-a-file-for-analysis

For McAfee you can submit it via Mail:
https://kc.mcafee.com/corporate/index?page=content&id=KB85567

For Trend Micro you need a Support Account:
https://success.trendmicro.com/solution/1119869-reporting-a-false-positive-issue-in-deep-security

Same goes for Palo Alto:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3aCAC

[hillu]

@simonai1254 Thank you.

[askvpb]

@simonai1254 Thank you.

Thanks you for looking ino this matter. Much appreciated.

[massmy]

Out of curiosity, did you try to strip the debug info with -ldflags '-s -w' and run the malware scan?

[hillu]

Out of curiosity, did you try to strip the debug info with -ldflags '-s -w' and run the malware scan?

Yes. This did not help.

I have decided for myself that life is too short to try finding workarounds to black box "security" buzzword products. (That time is better spent ranting about the sorry state of our industry.)

[cybgit]

Has anyone submitted this to vendors so they dont detect as a virus? I've recommended this tool be used internally and whilst some of the detections may be obscure, there are some big hitters detecting it there - cylance, cyberreason, palo alto.

[simonai1254]

I did nothing, only search for the places where you may put the sample in.

I have decided for myself that life is too short to try finding workarounds to black box "security" buzzword products. (That time is better spent ranting about the sorry state of our industry.)

I understand that completely, thanks anyways for your effort you put in so far!

[Neo23x0]

The file is too small. Append 10MB of binary zeros to the end of the binary to avoid these detections.

PS: I'm not sure if I'm kidding.

[cfrietschy]

Has anyone submitted this to vendors so they dont detect as a virus? I've recommended this tool be used internally and whilst some of the detections may be obscure, there are some big hitters detecting it there - cylance, cyberreason, palo alto.

We have reported this project and its binaries to ESET, TrendMicro and Talos Intelligence (Cisco) with a request to stop reporting the files as malware. We are currently waiting for official feedback.

[hreese]

I've hat the same problem with most of my golang binaries. FYI: packing binaries with upx usually increases the false positives.

I've upvoted (aka “increased the community score”) on VirusTotal. It may have a positive effect if enough people do it; I believe that antivirus software vendors get access to VTs data.

[AnomalRoil]

We had once a similar issue where ClamAv was flagging Gopass because of the IPstorm malware which is in Go and whose detection rules are terrible:
gopasspw/gopass#1807 (comment)

[simonai1254]

VirusTotal results are getting better...

[Firminator]

Yeah it's down to 6 now (just had it rescan).

[hillu]

Two remaining matches as of v0.10. Apparently, some people reporting to vendors did help some.