Malware Sample for Analysis

[DMelson]

Here is a sample file that MalwareBytes flagged as malicious (Malware.AI.3932381311 - SHA256 = "143632672DCB6EF324343739636B984F5C52ECE0E078CFEE7C6CAC4A3545403A").   What we need to know is what about this file caused the AI heuristics to flag it as malicious.  Item flagged by MBBR v4 yesterday.

Thank you.

Sample.zip

[1PW]

@DMelson here are some details on this specific file:

• See the answer for "I want to manually check my version of the SolarWinds.Orion.Core.BusinessLayer.dll for the vulnerability. Do you know a way to do that?" in the following FAQ: https://www.solarwinds.com/securityadvisory/faq
• https://www.virustotal.com/gui/file/143632672dcb6ef324343739636b984f5c52ece0e078cfee7c6cac4a3545403a/detection

Staffers may wish to consider moving this topic to the "False Positives -> File Detections" sub-forum. @AlexSmith

Thank you.

Edited December 16, 2020 by AlexSmith
Updated response

[shadowwar]

I have whitelisted this file. This doesnt seem the have the vulnerability. 

[JasonDemis]

This file is now marked as clean by all the known AV engines in VirusTotal:

https://www.virustotal.com/gui/file/143632672dcb6ef324343739636b984f5c52ece0e078cfee7c6cac4a3545403a/detection

Due to the SolarWinds incident, it came across our radar as well at https://virussamples.com, but appears to be benign.  

File type Win32 DLL

Magic PE32 executable for MS Windows (DLL) (console) Intel 80386 Mono/.Net assembly

File size 954.98 KB (977896 bytes)

Fille Name: SolarWinds.Orion.Core.BusinessLayer.dll