Jump to content

Falsely detect my software and EXEs created by it


Recommended Posts

My software 'Advance BAT to EXE converter' creates EXE files from BAT files. It does not do any harm to computers
or data.

Malwarebytes falsely detect my program and EXEs created by it as "MachineLearning/Anomalous.100%"

I sell this software and my paid customers are annoyed with these false positives.

This zip file contains a sample of batch files compiled to EXE with 'Advanced BAT to EXE Converter' and there are thousands of variations of these files. Anything close to these files must NOT be a false positive.

i have included compiled batch scripts in "COMPILED Batch Files" folder.
And i have included my compiler program files in "COMPILER" folder.

The compiled EXE are created from "bfchlp1.dat" and "bfchlp4.dat" from "Specially flagged files" folder with the encrypted batch file append at the end, There are also few bytes overwrite inside of the "bfchlp" files.

Can you please fix this? i have attached files and virustotal.com link

virustotal link : https://www.virustotal.com/gui/file/68d738fc849b1b6da8f62f8e58e928f2049c92b5ec7935498e8cf641ee3c91da/detection

The sample is in a password protected zip file
The password for the attachment is infected

FP421_password_infected.zip

Link to post
Share on other sites
  • Staff

Hi,

This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Also see here for more explanation: https://forums.malwarebytes.com/topic/238670-machinelearninganomalous-detections-and-explanation/
Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore.

This should be fixed by now. Please give it some time (max 10 minutes) in order to have it populate, so detection won't happen anymore.

 

Link to post
Share on other sites
6 minutes ago, gotek said:

12 hours after your fix, it is still falsely detected at virustotal.com

https://www.virustotal.com/gui/file/68d738fc849b1b6da8f62f8e58e928f2049c92b5ec7935498e8cf641ee3c91da/detection

can you please elaborate on this?

The engine format and configuration in VirusTotal is different than our consumer and corporate products’ default configuration. In VirusTotal we use a command-line engine with different configuration and detection techniques/heuristics which might detect more than the commercial product. There are also false-positive suppression mechanisms in the commercial product which are not present in the command-line engine in VirusTotal.

This file has been whitelisted for our commercial products and it is not detected anymore.

Link to post
Share on other sites

can you check these new files and confirm they are not false positives?

On 1/22/2021 at 7:11 AM, Porthos said:

The engine format and configuration in VirusTotal is different than our consumer and corporate products’ default configuration. In VirusTotal we use a command-line engine with different configuration and detection techniques/heuristics which might detect more than the commercial product. There are also false-positive suppression mechanisms in the commercial product which are not present in the command-line engine in VirusTotal.

This file has been whitelisted for our commercial products and it is not detected anymore.

 

FP_password_infected.zip

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.