Possible false positive Malware?

[hendrikus]

So I used MemoryUI loader almost a year ago for a Android emulator hack and it wasn't detected as anything bad back then.

 

Tried the latest version of the program on there website yesterday for different reasons and it quarantined the .exe

Would be nice to know if this is a false positive since I didn't have any problems with it almost a year back.

I hope the file is still intact since Norton was also flagging it, but I know Norton is a bit hyper sensitive.

 

File.zip

[hendrikus]

NjRlO.zipSorry i saw the zip has 0 bytes, this one should be correct.

[Atribune]

Could you provide a link to where you downloaded it? The file you attached is corrupt.

[hendrikus]

It won't allow me to post it.

[hendrikus]

Nvm now it suddenly does.. Here: hxxps://memorydownloader.net/

Edited October 14, 2018 by dcollins
Removed live link

[Atribune]

This should be fixed now.

[hendrikus]

Thank you.

[MiloMen]

22 hours ago, hendrikus said:

Nvm now it suddenly does.. Here: hxxps://memorydownloader.net/

The program has a malicious trojan code and is not recommended to use the program.

Virustotal

OWZhYzBhZDhjM.7z

Edited October 14, 2018 by dcollins

[hendrikus]

So it's no false positive? Thank you for the information.

Will definitely remove it.

[exile360]

It appears that most if not all of the detections on VirusTotal are heuristics/generic hits/detections, meaning the file could actually be malicious or it could just have one or more characteristics that make it appear to be malware such as using a particular kind of compression/encryption (a packer, which many of the detection names appear to indicate) and since a packer can be used for any kind of file, including malware but also safe files, this might in fact be a false positive.  While there are certain packers known to be used by malware authors quite often, it isn't impossible for a developer who isn't creating malware to also use the same one so this isn't the most reliable means of identifying a file as malware (though virtually all security vendors do it in order to play it safe as they'd rather have 1 false positive than allow a lot of malicious files to go undetected).  Once the Malwarebytes Research team has analyzed the file they will classify the item accordingly and whitelist it if it isn't a threat.