False Positive - Cypherguard for PDF treated as exploit

[TBS]

Cypherguard is a PDF protection app to stop illegal distribution of protected PDFs and their content. Malwarebytes treats it as some kind of memory hook exploit & blocks it.

In this case it is definitely not malicious activity.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 08/02/2021
Protection Event Time: 16:05
Log File: 31c3064d-69cb-11eb-9102-e0d55e07f52d.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1157
Update Package Version: 1.0.36821
Licence: Premium

-System Information-
OS: Windows 10 (Build 19041.746)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, , Blocked, 0, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: Adobe Reader
Protection Layer: Malicious Memory Protection
Protection Technique: Exploit code executing from Heap memory blocked
File Name: 
URL: 

(end)

[Arthi]

Hi TBS,

Thanks for posting, 

Please attach the following file here, so we can check what's going on and provide a resolution.

C:\ProgramData\Malwarebytes\MBAMService\logs\mbae-default.log

[TBS]

On 2/8/2021 at 4:55 PM, Arthi said:

Hi TBS,

Thanks for posting, 

Please attach the following file here, so we can check what's going on and provide a resolution.

C:\ProgramData\Malwarebytes\MBAMService\logs\mbae-default.log

Attached. Thanks

mbae-default.log

[TBS]

We are still having this issue. Any progress?

[Arthi]

Hi TBS,

Apologize for the delayed response.

Please go to Malwarebytes UI, Settings->Security Tab->Advanced Settings under Exploit Protection->Advanced memory protection Tab->uncheck "Malicious return address Detection" for Pdf reader

Hope that helps. Thank you.

[TBS]

That works. Thank you!