False positive due to obfuscation

[cuciu]

I was working on a program that blacklist some websites by adding them to system32/drivers/etc/hosts

Everything is fine until I obfuscate the code.

Malwarebytes detect it as MachineLearning/Anomalous.100%

false positive.zip

[miekiemoes]

I can't reproduce detection. Are you still getting the detection?

If so, Quit malwarebytes from the systemtray.
Then navigate to the following folder:

C:\ProgramData\Malwarebytes\MBAMService

In there, locate the file HubbleCache and delete it.

Restart Malwarebytes again. A new Hubblecache will then be created again, so it will properly pick it up and remember to not detect this anymore.

 

If still detected, please zip and attach the detection log. Thx!

[cuciu]

threat scan result.zip

I tried it and it wasn't detected anymore but when I tried with my own application it happend again. 

[miekiemoes]

Hi,

This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Also see here for more explanation:

Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore.

Can you zip and attach the two files it detected, so we can add it to our machinelearning engine to retrain?

[cuciu]

So because some malwares are obfuscated by the same obfuscator I used, the MachineLearning detect my program as an potential virus?

[cuciu]

Oh and I forgot to add the file.

files.rar

[miekiemoes]

Thanks. Yes, but we detect as suspicious/machinelearning. I'm sure other antivirus will detect this too. That's why it's always good practice to digitally sign files, especially when you obfusticate, in order to prevent Antivirus detecting these.