False positive for pyinstaller packed python file

[Evernow]

Hello

 

Currently working on a small program to grab sysinfo files to assist in troubleshooting, however my packed executable is getting false positives. I include here the packed executable created pyinstaller with the -F flag, the raw python file and the requested report

 

 

 

 

malwarebytespositives.7z fpreport.txt

[miekiemoes]

Hi,

This is indeed a false positive by our additional machinelearning engine we have implemented.
This will get fixed.

Thanks for reporting!

[Evernow]

On 5/6/2021 at 2:05 AM, miekiemoes said:

Hi,

This is indeed a false positive by our additional machinelearning engine we have implemented.
This will get fixed.

Thanks for reporting!

Thank you for the response, is there an ETA on when this will be done?

 

Thanks!

[Porthos]

33 minutes ago, Evernow said:

Thank you for the response, is there an ETA on when this will be done?

I do not have a detection on the files from your attachment. Are you still seeing a detection?

[Evernow]

3 minutes ago, Porthos said:

I do not have a detection on the files from your attachment. Are you still seeing a detection?

Version1.3.exe.7zYes I am, at least I am from a later revision of the same software which I am attaching now.

[AdvancedSetup]

This one is detected for me.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 5/12/21
Scan Time: 4:30 PM
Log File: 076d593a-b37a-11eb-a2f0-00d8617a9654.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1292
Update Package Version: 1.0.40344
License: Premium

-System Information-
OS: Windows 10 (Build 19042.985)
CPU: x64
File System: NTFS
User: computer\pc

-Scan Summary-
Scan Type: Custom Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 1
Threats Detected: 1
Threats Quarantined: 0
Time Elapsed: 0 min, 9 sec

-Scan Options-
Memory: Disabled
Startup: Disabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
Generic.Trojan.Malicious.DDS, D:\DOWNLOADS\VERSION1.3.EXE\VERSION1.3.EXE, No Action By User, 1000002, 0, 1.0.40344, 4CA7808D37D0B52AD0B65680, dds, 01241484, AF12E88A0E1D09989C00183808A9FFE2, 53FF529750705440E9FF54A03E2B5E792D5CBD35E33C6EF027B45BC47628052E

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

 

 

[cli]

Is this the final version? We advise developers to whitelist the directories they are developing from and let us know if their release version is still detected. You can read more in MachineLearning/Anomalous Detections and Explanation.