Possible false positive in Vendor provided variant of OpenTrack

[RBWelsh]

VirusTotal - File - 6cbfb5ab5599d44db638e6fb6958bc4625b2eb4da83039a6997b36a3128157ed

1 Vendor only reports detection. MalwareAntibytes lists it against their detection system as MachineLearning/anomalous.97%

TrackHat2.zip

[miekiemoes]

Hi,

This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Also see here for more explanation: https://forums.malwarebytes.com/topic/238670-machinelearninganomalous-detections-and-explanation/
Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore.

Edited to add: I can't reproduce detection on this file. Are you sure this is the exact file you want to report? Thx!

Edited June 1, 2022 by miekiemoes

[RBWelsh]

Thanks for confirming that - I had read that it was a 97% variance detection from your list of programs in the heuristic detection you run - therefore possibly a false positive. But I decided it worth sending because of the one vendor who also flagged it up when checked on VirusTotal. As to whether it is the file that I wished to report, I've just recalled that this didn't occur on the installation (the exe file I submitted), but on first run of the installed program. Sorry about that. I'll restore the file from quarantine that did trigger the alert, check that using VirusTotal and resubmit accordingly - although I accept it is probably OK and will help, as you say, with fine tuning the engine. I also have alerted the provider of the software (he provides his own build of the OpenTrack software to support his product - Trackhat. I'm sure he'll want to look into it in case other customers start reporting it has getting quarantined.

[miekiemoes]

If you have the detection log where it shows the detection (as it also shows additional information about the filename/file itself), that should be fine as well. 

[RBWelsh]

VirusTotal - File - 5575cfa319d9346a33efba6446046a4c382e2ef42f65de7c66a244bc84b931ce

Here is the exe file resulting from the installation of the file I previously submitted. It confirms your own detection as reported, but a further three vendors suspecting mlaware.

Trackhat2.2.zip

[miekiemoes]

Thx. It looks like this file has been whitelisted already, so should no longer be detected anymore.

Please note that it might take some time before Virustotal reflects this in the results, but at least it won't be detected locally anymore.

[RBWelsh]

So despite the other three vendor reports of suspicious content, MalwareBytes has determined it is OK and whitelisted it? So if I run it now I should be OK? 

[miekiemoes]

Yes, this file is not malicious :)

 

[RBWelsh]

Thank you for such a speedy and reassuring response. I've trusted Malwarebytes for years now to keep me safe and have never been let down once. So when anything pops up I take it very seriously indeed. 

[miekiemoes]

That's good to hear. :)