Jump to content

False positives of obfuscated Go binaries - Malware.AI.1038955078


gophers

Recommended Posts

See https://www.virustotal.com/gui/file/22be69d5dbc71dc97526cd5e2de6c29c9c7f698032d20fec999b3f652e8599b5/detection

Binary builds using https://github.com/burrowers/garble gets detected as a Malware.AI.xxxx.

Golang code of that executable is:
 

package main

import "fmt"

func main() {
        fmt.Println("hello")
}

Build using garble (from master) from the above url and Go 1.21.5
GOOS=windows garble build (needs also go https://go.dev/dl/)

Link to post
Share on other sites

  • Staff

From MachineLearning/Anomalous Detections and Explanation:

Quote

 If you are a developer, while building your application,  I suggest you exclude the working/building directory from detection via the exclusion settings in Malwarebytes. This since our Anomaly detection might possibly detect some of the files you are building.
Once the application/project is final and ready to be shared with others, in most cases it won't be detected anymore since it won't be triggered as "anomalous" anymore either.

In case a "final project" is still detected, please let us know (include the sample), so we can add it to our database of known good apps as well to prevent this in the future.

Thanks for reporting.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.