Author Topic: False Positive Question  (Read 731 times)

0 Members and 1 Guest are viewing this topic.

Offline Mrmike110

  • Newbie
  • *
  • Posts: 1
False Positive Question
« on: November 19, 2022, 07:20:45 AM »
I am currently working with a developer whom I have never met. I have hired him through online channels to code a program for me. Can you look at my VT and tell me if this is a false positive because we are working with an executable file?

https://www.virustotal.com/gui/file/8ec6f045a8977b9eb5db2582b0ea746f2d9d7f20baa7029c7f58a0d22d3b0413/detection

The program creates a database in my appdata folder. So I don't know if AVAST is thinking that it is attacking my computer.

Offline polonus

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 33568
  • malware fighter
Re: False Positive Question
« Reply #1 on: November 19, 2022, 02:18:54 PM »
If you have met with an FP, it could be one vendor to flag it, but certainly not fourteen.
Now 17 to detect it, malcode as an adware trojan.

Is someone trying to check it could go under the detection radar?

Moreover that file is not signed. Is this executable the real McCoy.
Were you duped through fraud to check it or is this a deliberate action?

Consider also: 2 matches for rule Creation of an Executable by an Executable by frack113 from Sigma Integrated Rule Set (GitHub)  Detects the creation of an executable by another executable


polonus
« Last Edit: November 19, 2022, 02:28:30 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 33568
  • malware fighter
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!