Jump to content

CMake File Malware.AI Detection


Recommended Posts

Dear Malwarebytes team,

Malwarebytes detected a CMake file as malware, which I think is a false positive. The file is called "CMakeCXXCompilerId.exe".

This CMake version comes bundled with Microsoft Visual Studio 2019 and is being used by CLion IDE from JetBrains on my Computer. CMake version: 3.17.5

I've added the log as an attachment.

Kind regards


Link to post
Share on other sites

Just now, cli said:

Thanks for reporting, this will be fixed in 10 minutes.

The uploaded file doesn't get detected anymore on my PC. However, whenever I create a new project in the CLion IDE, "CMakeCXXCompilerId.exe" gets compiled from source and gets detected as Malware.AI again. The only difference between the files that I could find is the compilation date stored in the PE header and somewhere else in the binary, which breaks the signature I guess?

I've attached the log and and the file from a newly created project.

CMakeCXXCompilerId_second_file.zip malwarebytes_second_log.txt

Link to post
Share on other sites

  • Staff

I see. This was detected by our machine learning engine. We advise developers to add their working/building directory to their Allow List to keep these detections from happening. The software typically will no longer be detected by the time the project is finalized, but if it is please let us know.

For more information, please read MachineLearning/Anomalous Detections


  • Thanks 1
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.