Adware.Install is detected.

[TLFI]

Hello, I am Peter, a software developer at a company that distributes software for payroll processing. We regularly release hotfixes for our applications.

 

Sometimes, we encounter the issue that malware in the hotfix applications detects the problem <Adware.Install> and, as a result, deletes the application.

 

I have analyzed the issue and was able to reproduce it. Apparently, it's the size of the generated .exe and not its content that's responsible for this.

 

I have set up a test environment for this purpose. To conduct the test, I created 3 Hotfix.exe files. All three applications contain the file (lo_hotfix.pbd) that we want to deliver to our customers; the Hotfix.exe does nothing more. To replicate the issue, I additionally created 2 PDF files with arbitrary content and added them to the patch one after the other.

 

Here are the results:

 

Hotfix_original.exe -> Content: lo_hotfix.pbd -> Adware.Install is detected.

Hotfix_detected.exe -> Content: lo_hotfix.pbd + pdf_1.pdf -> Adware.Install is detected.

Hotfix_not_detected -> Content: lo_hotfix.pbd + pdf_1.pdf + pdf_2.pdf -> Adware.Install is not detected.

 

It appears to me that the size of the Hotfix.exe is responsible for triggering the problem.

 

Can you please assist me with this? How can we address the issue in the future? Does the .exe file need to have a certain size?

 

with kind regards

malware.zip

[miekiemoes]

Hi,

This is an old FP and will get corrected in next database update.

Thanks for reporting!

[TLFI]

THX