WebKitX ActiveX and Samples

[eliasp]

Dear sir / madam,

mobileFXStudio Ltd is UK based company and we produce ActiveX software components for OLE/COM enabled programming languages.

Lately we have been receiving numerous emails from both customers and evaluators that our product WebKitX ActiveX is blocked by MalwareBytes products during download and generates positive ntofications during scan when analysed by Malware.AI engine.

We believe this is due to the nature of the product which is an OLE/COM Wrapper of Chromium Embedded Framework (CEF3). The software is used by companies that wish to add HTML5 Webkit Browser to their software products and being Chromium implements a vast array of device, system and file access routines.

Our setup files are digitally signed and we compile CEF engine, our products, and the included sample exectutables on an isolated build server running Malware Bytes Premium 4.3.0.

Product	MD5	SHA-1	Download Link
WebKitXActiveX WinXP x86 v2.2.0.14683	1a4dee4e56b3c9afa8fd848564b88fa5	17f406587fccbfa226c8c5e5bfac463d089fe4e3	WebKitX_CEF3_ActiveX_WinXP_x86_v2.2.0.14683.exe
WebKitXActiveX x64 v4.0.0.14679	c0c7f0a2665e832da8ad257a0893061c	4536d555d65f359b913880f290cc2be46a087df3	WebKitX_CEF3_ActiveX_x64_v4.0.0.14679.exe
WebKitXActiveX x86 v4.0.0.14679	c1110781239f11d6b5a1a42ba63ad7d0	0688ba2565f494efc91b3d1f0938843dc7afdaa8	WebKitX_CEF3_ActiveX_x86_v4.0.0.14679.exe

 

https://www.webkitx.com/FF0D793D-889E-40F4-A491-44049F4F38AD/WebKitX_CEF3_ActiveX_WinXP_x86_v2.2.0.14683.exe

https://www.webkitx.com/FF0D793D-889E-40F4-A491-44049F4F38AD/WebKitX_CEF3_ActiveX_x64_v4.0.0.14679.exe

https://www.webkitx.com/FF0D793D-889E-40F4-A491-44049F4F38AD/WebKitX_CEF3_ActiveX_x86_v4.0.0.14679.exe

 

 

Due to size restrictions we cannot upload the files in question so we provide direct download links to our software products in the list above. The product web site is 

https://www.webkitx.com/

 and has a valid SSL certificate. We kindly submit our software claiming it generates false positive results asking for your aid in analysing the files.

Kind regards,

 

 

Mr. Elias Politakis | CTO
www.mobilefx.com

 

Edited March 18, 2021 by AdvancedSetup
disabled live hyperlinks and removed personal information

[cli]

I followed the link you provided to download the file, installed it, and did a scan afterwards and didn't see a detection. Since it was originally detected by our machine learning engine, it may have been automatically fixed. In order to confirm, do you have a scan log? Thanks.

[eliasp]

Thank you for the quick reply,

We run several scans as well today and we too were unable to detect any problems, so it does look like the AI has adopted this present releases. I am attaching a screenshot provided by a customer yesterday that shows Malware (ai Score=85). I have requested the customer to provide scan report and we will post it here as soon as we have it.

It would be particularly beneficial if MB would improvise services for ISVs in order to reduce false positive results. For example, as an ISV we would welcome in our build pipleline an MB software that would scan the newly builds, and if are free of malware, then digitally sign our software. This signature would then act as a safety-becon when MB AI scans the files elsewhere.

Kind regards, 

E.

 

[eliasp]

We got this link from customer, if this helps:

https://www.virustotal.com/gui/file/c91f484e89a548791a41744a4bb1f05c1e5afed5a47ec8bff2511e47bc4c5849/detection

Kind regards,

E.

[Porthos]

4 hours ago, eliasp said:

We got this link from customer, if this helps:

https://www.virustotal.com/gui/file/c91f484e89a548791a41744a4bb1f05c1e5afed5a47ec8bff2511e47bc4c5849/detection

Kind regards,

E.

If you recheck that link, you will see Malwarebytes is not detecting it anymore. You have an uphill battle with the other vendors though.