Open Office being quarantined as generic ransomware

[Shino2]

Open Office Calc (soffice.exe) has been recently being flagged as ransomware within the last few days. I have attached the provided log file.

To reproduce: Save an Open Office Calc file after making changes using the most up-to-date version of the Open Office suite. However, it will only be quarantined a small fraction of the time, and I've been unable to track down any particular indicator of what may be triggering the quarantine only some of the time.

One possible variable may be that the file(s) being edited are in a local dropbox folder, though I have no way to determine if that is the case because Malware Bytes only flags open office as ransomware once out of every few dozen or so individual saves (At least going off of my current experience, with this happening a few times now), which means testing this would be rather time consuming.

As a side note, and this is the ultimate reason I am bothering to report this: When malware bytes quarantines (And closes) the application, the file that was being saved when the quarantine was triggered is sometimes replaced with a 0KB empty file. This potential for a loss of a large amount of data is rather concerning, and I would have lost a good deal of data myself if I didn't make it a point to keep proper backups. As with before, this may be related to Dropbox, but I've been unable to test due to the difficulty in reproduction.

FalsePositive.txt

MBAMSERVICE.LOG

Edited July 2, 2017 by Shino2
Added additional logs

[thisisu]

Hi Shino2,

Thanks for reporting. This should be fixed now. Let us know if you continue to see this file flagged by us.

Regards