False Positive, Malware Generic

[TheVogon]

Believe that this is a false positive detection:

 

 

keygen.rar

[Porthos]

7 hours ago, TheVogon said:

Believe that this is a false positive detection:

It is not as safe as you think. Please see the Virus total results below. As with all Keygens, use at your own risk. Use of key generators  is never recommended.

https://www.virustotal.com/gui/file/9e72ef7c44d57115a51434b6a9c46b478cea49a9f8a997ba1af2c01fd5659949/detection

 

Edited July 10, 2020 by Porthos
Edited for clairity.

[TheVogon]

Most of which are generic / keygen alerts. On testing it doesn't download anything or open any external connections as far as i or my router can see and the PC scans clean afterwards.

And i dont care what your moral view of what the software happens to be, that's utterly none of your business.

 

Maybe someone who actually has a knowledgeable view on if this is malware rather than looking at a well known to often be incorrect website can comment on what it actually does undesirable if so.

 

 

[TheVogon]

[Porthos]

2 hours ago, TheVogon said:

Maybe someone who actually has a knowledgeable view on if this is malware rather than looking at a well known to often be incorrect website can comment on what it actually does undesirable if so.

Please be patient, A researcher will be assisting you. Th VT link was for staff use.

[TheVogon]

1 hour ago, Porthos said:

Please be patient, A researcher will be assisting you. Th VT link was for staff use.

OK, suggest that references to your views on use are best avoided then. Risk comments were fine.

Yes no rush for this. I have a MWB email box address for samples that are urgent.

This is so far for personal use although i'm open to considering it for corporate as zero day detection speed is only beaten (sometimes!) by Kaspersky so far in my experience.

 

[Porthos]

50 minutes ago, TheVogon said:

OK, suggest that references to your views on use are best avoided then. Risk comments were fine.

I apologize if you were offended. These are not just my personal view. From past experience (since 2008) as I do not work for Malwarebytes, The company generally does not support Keygens and usually will just change the detection to "riskware" instead of Trojan but still block it in most cases.

I am sure they will dissect either way. Because of the AI note in the log it was Probably detected by the new  AI engine as shown below in the screenshot.

It is possible that there is nothing wrong with the file..

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/10/20
Scan Time: 5:27 PM
Log File: 83c728ea-c2fc-11ea-bf39-001a7dda7102.json

-Software Information-
Version: 4.1.2.73
Components Version: 1.0.979
Update Package Version: 1.0.26671
License: Premium

-System Information-
OS: Windows 10 (Build 19041.329)
CPU: x64
File System: NTFS
User: I7-PC\SAPC

 

File: 1
Malware.AI.2638997795, C:\USERS\SAPC\DESKTOP\MALWARE SAMPLES\KEYGEN\KEYGEN.EXE, No Action By User, 1000000, 0, 1.0.26671, 9E63AE873E3E91D99D4BE923, dds, 00801917

 

 

 

 

Edited July 10, 2020 by Porthos

[cli]

Thanks for reporting, this has been fixed.

[cli]

It has come to my attention that I was unclear. To clarify, the detection was removed. 

3 hours ago, Porthos said:

From past experience (since 2008) as I do not work for Malwarebytes, The company generally does not support Keygens and usually will just change the detection to "riskware" instead of Trojan but still block it in most cases.

Yes, that's true. Porthos has been in the forums way longer than I have, and a great help at that. 😄 

In this particular case, since this was detected by the additional machine learning engine and the file is non malicious, I removed the detection.

[TheVogon]

Thanks. a more specific categorisation would have been fine, but removing the detection is ideal.