Sejda Desktop (Exploit False Positive while splitting PDF)

[revpjbbq]

It is not clear if I should be placing this report in the Exploit Forum, based on the name of the notification, or as suggested by Sejda Desktop knowledge base to place it in the File Detection forum.

 

Malwarebytes interfering with Sejda Desktop while attempting to split a pdf.

I had to turn off Exploit Protection to split the PDF I just created.

Sejda Desktop sent me to a support page that asked if I was using Malwarebytes, and if so, to report it here on your forums.

 

 

Sejda Desktop Exploit.txt

[Porthos]

2 hours ago, revpjbbq said:

It is not clear if I should be placing this report in the Exploit Forum

You are in the correct place. I have asked someone to assist you.

In the mean time, Have you made ANY changes in the advanced exploit section since installing Malwarebytes?

If so or unsure, reset defaults please.

Edited August 21, 2023 by Porthos

[revpjbbq]

4 minutes ago, Porthos said:

You are in the correct place. I have asked someone to assist you.

In the mean time, Have you made ANY changes in the advanced exploit section since installing Malwarebytes?

I just went in to the advanced settings sections, took screenshots of each setting page, hit the Restore Defaults button on each page, hit the Apply button.

After comparing the screenshots to the settings as they are now, there were no changes at all. Nor were any changes observed when I hit either buttons, but I wanted to be sure.

I've had Malwarebytes installed for a few years, so I had to check in this way, but I didn't think I had made any changes, and the results are as I expected.

[Arthi]

Hi revpjbbq,

Thanks for posting.

Can you please go to the settings menu->Exploit protection-> Protected applications and turn off these 2 toggles. Thanks.

[revpjbbq]

On 8/22/2023 at 8:06 PM, Arthi said:

Hi revpjbbq,

Thanks for posting.

Can you please go to the settings menu->Exploit protection-> Protected applications and turn off these 2 toggles. Thanks.

I few minuted ago I have toggled java.exe (Java) to the off position. I'm inclined to turn it back on as this issue has only occurred the one time.

jp2launcher.exe (Jave Process Launcher) did not have an entry.

Additional information:

This Exploit Protection trigger and blocking only occurred when splitting a particular two page PDF with Sejda PDF Desktop I created with PDF Creator 5.1.1.

Other PDFs I have created afterwards have not triggered this exploit protection in the past two days. Also PDF Creator 5.1.2 has been released and installed on my system at this time and I have successfully split PDFs without turning off java.exe (Java) exploit protection during that time.

I can't obfuscate the PDF due to the nature of the document probably without changing its structure in a way that would not make it useful to determine the cause for it to trigger an exploit protection in Malwarebytes.

Thank you for all of your assistance. I will consider this the solution and will make a new post if it happens again in the future.

Please let me know if there is any data I can collect or share further, if you wish.