False Positive

[Rami]

Hi,

I'm creating script that contains word "Ransomware" in it (as a text for one path to some folders)

when i run it MBAR detects it as ransomware! 

attached the script and the required files as a zip.

 

Thank you

Malwarebytes Anti-Ransomware.zip

[1PW]

Hello Rami and welcome back:

Please forgive the delay as a pursuit was undertaken involving cross-checks of SHA256 digests.

Available data strongly suggests a false positive, and if it has not already been done, you may wish to make the following temporary full pathname file entry in MBARW GUI Dashboard -> Exclusions:

                         C:\Users\rami.alhaddad\Desktop\RwJail_Setup.exe

Reference: https://www.virustotal.com/file/13f2331dbb536d062c1867df31ebf07c2076d5a42fe7441b4b638c60222ce0d8/analysis/

versus MBARW Beta7 calculated SHA256 digest: d22bd9af1ca8e7c36ac4a846d230671adeb5cbb6be50ad403289793b4d3a1aaf

Note: A successful compare of SHA256 digests could not be made between the executable archive you have attached and the calculation made by MBARW Beta7.  The possibilities of what caused the digest mismatch are many and further speculation would likely be non-productive.

At any time, a MBARW development team member, QA team member or Staffer may request the above temporary exclusion be altered/deleted.

Thank you for beta testing MBARW and your valuable feedback.

Edited August 26, 2016 by 1PW