bugDenemo - Bugs: bug #63489, Firefox says download is malware,...

 
 

bug #63489: Firefox says download is malware, virus total positive results

Submitter:  None
Submitted:  Thu 08 Dec 2022 11:53:02 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Need Info
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 08 Dec 2022 12:05:33 PM UTC, comment #1: 

It is overwhelmingly likely that these are the usual false positives that virus detectors make. (I say that because the files are generated avoiding the use of any proprietary operating systems/software which would make an attack extremely "niche").
Unless you can find the program misbehaving in some way there is nothing to do - these virus detector companies are not in my experience in the business of worrying much about false positives unless they involve popular software backed by companies who might sue them!
You may see earlier, similar, reports - but no actual malware has ever been reported on the executables on denemo.org

Richard Shann <rshann>
Group administrator
Thu 08 Dec 2022 11:53:02 AM UTC, original submission:  

Tried downloading www.denemo.org/~rshann/Denemo2.44Installer.exe from http://www.denemo.org/downloads-page/

Firefox said download is malware after download completed.

Screesnhot https://imgur.com/a/pZesCq4

I tried a virus total scan of the url - it said some vendors had detected problems. I refreshed the scan - it all came out fine.

I then downloaded the zip version of 2.6. http://denemo.org/~rshann/denemo-2.6.0.zip

I extracted it, ins a sandbox, and ran denemo.bat.

I uploaded /bin/denemo.exe to virus total. The behaviour said that some file integrity checks failed among other things.

https://www.virustotal.com/gui/file/8aad5043dcadfe3457e3f897a76ae47488f1beba7a8f778c67cfe75752412ad5/behavior


1 match for rule File deletion via CMD (via cmdline) by Ariel Millahuel from SOC Prime Threat Detection Marketplace
Detects "cmd" utilization to self-delete files in some critical Windows destinations. View rule View matches

1 match for rule Failed Code Integrity Checks by Thomas Patzke from Sigma Integrated Rule Set (GitHub)
Code integrity failures may indicate tampered executables. View rule View matches

1 match for rule Use Remove-Item to Delete File by frack113 from Sigma Integrated Rule Set (GitHub)
Powershell Remove-Item with -Path to delete a file or a folder with "-Recurse"

I refreshed virus total scan. Same result.
https://www.virustotal.com/gui/file/8aad5043dcadfe3457e3f897a76ae47488f1beba7a8f778c67cfe75752412ad5/behavior

I zipped the /bin folder and checked in virus total

Several vendors tagged the zip file as malicious

https://www.virustotal.com/gui/file/2a410534d394243ac4fae298ee5754a31690027377ffc0dc1ce6853406bfbae4?nocache=1


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rshann (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-12-08 rshann StatusNone Need Info
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-0329.
    Corresponding source code