PS2EXE false positive

[Hope-IT-Works]

PS2EXE is a PowerShell-script to executable converter. Many executables that are generated by this converter are getting flagged as malware.

Here is an example from VirusTotal:
https://www.virustotal.com/gui/file/106a07262b7955b8996bf836908a7bc26df4930b5bd5d451d648086bd1bf7b79/detection

Here is the GitHub Repository of PS2EXE:
https://github.com/MScholtes/PS2EXE

Have a nice day,
Tobi | Hope-IT-Works

[TwinHeadedEagle]

Hi,

This is a False Positive and it will be fixed in the next update.

[Hope-IT-Works]

Hello, I was hoping the update would solve the problem. But it didn't.

Here are more examples that are flagged as malicious software:

https://www.virustotal.com/gui/file/9ea8ec75f1f4d3cb640444fdff02700ed985a3c94f48ee37b4775fd32b637f59/detection

https://www.virustotal.com/gui/file/165c6841b1e075d5e301c62078ea6d505c822d33a16efcc65342255a8790f4f6/detection

https://www.virustotal.com/gui/file/130305dcc086d8ebd26a3244cd29bf4939f1034fa368bcfc1a03d5075abfda9e/detection

https://www.virustotal.com/gui/file/c952341c4157b0ca003f211a8c4b44ae9cc294c51d0236e63f07b03cf2eb93ab/detection

https://www.virustotal.com/gui/file/c952341c4157b0ca003f211a8c4b44ae9cc294c51d0236e63f07b03cf2eb93ab/detection

Would it help if the PowerShell scripts were signed?

Let me know if you need something from me.

Have a nice day and thanks in advance,
Tobi | Hope-IT-Works

[Porthos]

16 minutes ago, Hope-IT-Works said:

Here are more examples that are flagged as malicious software:

Is the actual installed Malwarebytes detecting this or are you just going off the VT results?

[Hope-IT-Works]

42 minutes ago, Porthos said:

Is the actual installed Malwarebytes detecting this or are you just going off the VT results?

Hey, the actual Malwarebytes software is detecting these files as malicious software. I thought that the Virus Total analysis would help to understand why these files are getting detected. Let me know if you need more information. 

Greetings,

Tobi | Hope-IT-Works

[TheRickH]

We have the same issue with malware bytes flagging executables created by PS2EXE as malware.

Close_AIB_Summary2017.TXT

[Porthos]

2 hours ago, TheRickH said:

flagging executables created by PS2EXE as malware.

We need the detection logs.

[TheRickH]

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 4/19/22
Protection Event Time: 1:43 PM
Log File: 41f8871e-c008-11ec-b7c2-001a7dda7113.json

-Software Information-
Version: 4.5.8.191
Components Version: 1.0.1666
Update Package Version: 1.0.53887
License: Premium

-System Information-
OS: Windows 10 (Build 19044.1620)
CPU: x64
File System: NTFS
User: System

-Blocked Malware Details-
File: 1
Trojan.Crypt.XZZ.Generic, E:\Close_AIB_Summary2017.exe, Quarantined, 12639, 1033831, 1.0.53887, , ame, , 99105EBFDA972CBDEAEBCA8C05E5E62F, 7508024B1D798082BC7E77FAE8A2FB60706CBA52D76511913C714161E9928F14

(end)

CloseFile Malware.txt

[HWG]

The current Malwarebytes software still detects the .exe files created with PS2EXE as malicious software.
This is what the Malware.AI.(id-nr) detection it is a false positive notification, i think.

Does anyone have an idea how to deal with this?

[HWG]

Does anyone have an idea how to deal with this?

[Porthos]

@HWG Create a new topic and do not add to old topics. In the new topic, include the log and zip and attach the detected file.