False positive in Visual studio generated exe

[alberti47]

Hi

I downloaded a .net solution as source code.

The assembly is compiled without errors, as all other my applications.  At the start I get the following error

Malwarebytes
www.malwarebytes.com

-Dettagli log-
Data evento di protezione: 08/10/22
Ora evento di protezione: 09:04
File di log: 6ba27146-46d7-11ed-97d0-00ff825fb90a.json

-Informazioni software-
Versione: 4.5.14.210
Versione componenti: 1.0.1767
Aggiorna versione pacchetto: 1.0.60772
Licenza: Premium

-Informazioni sistema-
SO: Windows 10 (Build 19044.2006)
CPU: x64
File system: NTFS
Utente: System

-Dettagli malware bloccati-
File: 1
MachineLearning/Anomalous.100%, D:\UniERM-ReportDesigner-master\src\RdlDesign\bin\Debug\UniERMReportDesigner.exe, In quarantena, 0, 392687, 1.0.60772, , shuriken, , BDA5DBE47652250EA620878ABF3604C5, 009B3815642AB582AC9B45D71DE797FF73984DA0B5C70A79DC099AD897780E66

(end)

I dont know how to solve this problem. I didn't find any strange error in source code, and no special librarys used unles standard Microsoft.

The warning dont tell me any useful information.

Could You help ?

Regards

 

[alberti47]

as more information this is the json diagnostic :

6C19307AD40048D2E52CA3AEDA1F0DEE1D6C305D6969BA3E6039DD439937C9D3
{
   "applicationVersion": "4.5.14.210",
   "chromeSyncResetQueryRequested": false,
   "chromeSyncResetQueryResult": false,
   "clientID": "",
   "clientType": "rtp",
   "componentsUpdatePackageVersion": "1.0.1767",
   "coreDllFileVersion": "3.0.0.1263",
   "cpu": "x64",
   "dbSDKUpdatePackageVersion": "1.0.60772",
   "detectionDateTime": "2022-10-08T07:04:15Z",
   "fileSystem": "NTFS",
   "id": "6ba27146-46d7-11ed-97d0-00ff825fb90a",
   "isUserAdmin": true,
   "licenseState": "licensed",
   "linkagePhaseComplete": true,
   "loggedOnUserName": "System",
   "machineID": "",
   "os": "Windows 10 (Build 19044.2006)",
   "schemaVersion": 20,
   "sourceDetails": {
      "aggressiveMode": false,
      "ddsigEnabled": true,
      "filesScannedByIG": 0,
      "shurikenEnabled": true,
      "type": "rtp"
   },
   "threats": [
      {
         "ddsSigFileVersion": "",
         "linkedTraces": [

         ],
         "mainTrace": {
            "archiveMember": "",
            "archiveMemberMD5": "",
            "cleanAction": "quarantine",
            "cleanResult": "successful",
            "cleanResultErrorCode": 0,
            "cleanTime": "2022-10-08T07:04:16Z",
            "generatedByPostCleanupAction": false,
            "hubbleRequestErrorCode": 0,
            "id": "6ba27147-46d7-11ed-bc47-00ff825fb90a",
            "igExitCode": "",
            "isPEFile": true,
            "isPEFileValid": true,
            "isWhitelistedByAdsInfo": false,
            "linkType": "none",
            "objectMD5": "BDA5DBE47652250EA620878ABF3604C5",
            "objectPath": "D:\\UniERM-ReportDesigner-master\\src\\RdlDesign\\bin\\Debug\\UniERMReportDesigner.exe",
            "objectSha256": "009B3815642AB582AC9B45D71DE797FF73984DA0B5C70A79DC099AD897780E66",
            "objectSize": 1171456,
            "objectType": "file",
            "resolvedPath": "D:\\UniERM-ReportDesigner-master\\src\\RdlDesign\\bin\\Debug\\UniERMReportDesigner.exe",
            "suggestedAction": {
               "archiveDir": false,
               "chromeExtensionOther": false,
               "chromeExtensionPreferences": false,
               "chromeExtensionSecurePreferences": false,
               "chromeExtensionSyncData": false,
               "chromeUrlOther": false,
               "chromeUrlSecurePreferences": false,
               "chromeUrlSyncData": false,
               "chromeUrlWebData": false,
               "disableHubbleWhiteListing": true,
               "disableSignatureWhiteListing": true,
               "fileDelete": true,
               "fileReplace": false,
               "fileTxtReplace": false,
               "folderDelete": false,
               "isChromeObject": false,
               "isDDS": false,
               "isDoppleganging": false,
               "isExternalDetection": false,
               "isPUP": false,
               "isShuriken": true,
               "isWMIEventConsumer": false,
               "killProcess": false,
               "minimalWhiteListing": false,
               "moduleUnload": false,
               "noLinking": true,
               "physicalSectorReplace": false,
               "priorityHigh": false,
               "priorityNormal": false,
               "priorityUrgent": false,
               "processUnload": false,
               "regKeyDelete": false,
               "regValueDelete": false,
               "regValueReplace": false,
               "shortcutReplace": false,
               "silentMode": false,
               "singleDelete": false,
               "testingMode": false,
               "treatAsRootkit": false,
               "useDDA": false,
               "verifyResolvedPath": true,
               "whitelistCheckError": false
            },
            "winVerifyTrustResult": {
               "expectedError": false,
               "lastErrorCode": 0,
               "wvtCalled": false,
               "wvtResult": 0
            }
         },
         "ruleID": 392687,
         "ruleString": "",
         "rulesVersion": "1.0.60772",
         "srcEngineComponent": "shuriken",
         "srcEngineThreatNames": [

         ],
         "threatID": 0,
         "threatName": "MachineLearning/Anomalous.100%"
      }
   ],
   "threatsDetected": 1
}

[Porthos]

Could you un-quarintine and zip and attache the affected file just in case.

[alberti47]

Hi.

I've enclosed the complete application folder just after assembly.

Thanks. Regards

Application.zip

[Spud]

Thanks, this has been fixed.

[alberti47]

.... ??? .....

I dont' understand : what has been fixed ?

If the problem is related to MalWare a new release will be available ?

If the problem is in Visual Studio code generator ?

Could You give a better explanation ?

Best regards

3 hours ago, Porthos said:

Could you un-quarintine and zip and attache the affected file just in case.

 

[Porthos]

9 minutes ago, alberti47 said:

If the problem is related to MalWare a new release will be available ?

The file should not be detected anymore. It was a false positive.

Edited October 8, 2022 by Porthos

[alberti47]

Thanks for the answer ..... but the program is still detected as malware and put in quarantine !

Regards

[Porthos]

14 minutes ago, alberti47 said:

Thanks for the answer ..... but the program is still detected as malware and put in quarantine !

Regards

Please clear your hubble cache by doing the following:

1. Click on the Malwarebytes icon in the system tray
2. Select "Quit Malwarebytes"
3. Navigate to %PROGRAMDATA%\Malwarebytes\MBAMService
4. Delete the file HubbleCache
5. Open Malwarebytes

[alberti47]

Thanks for Yr effort to solve the problem !

I'm sorry to tell You that problem remain also after deletion of HubbleCache, and machine reboot , and Malware check for updates !

Best regards

[alberti47]

Hi.

Last test was made about 5 hours ago.  Then I went back home and I reboot the Pc.  Now it works .... Nothing else to say ... No explanation for me.

Aniway Thanks and Best regards