XGecu Programmer Forums - Powered by Discuz! Board

标题: Virustotal showing xgproV1267 as having malware?? [打印本页]

作者: medtech1 时间: 2024-6-17 06:41 标题: Virustotal showing xgproV1267 as having malware??

Virustotal showing xgproV1267 as having malware??

Package details:
T48/T56/TL866II Plus Programmer Application Software (Chinese/English)

Download source:

http://www.xgecu.com/MiniPro/xgproV1267_setup.rar

xgproV1267_setup.rar virustotal.com has one red flag.
( f8bf97405dfc33d1f2694ec690b95fa71e45e496c73da9ac98da1f7953becd2a [url=]xgproV1267_setup.rar )[/url]

DeepInstinct MALICIOUS

After unpacking, XgproV1267_Setup.exe virustotal.com shows three red flags:
(81c3ba9e7b008d0bb83d9857384dd59c997dc79779c018ffdf0abfd21dcb572c [url=]XgproV1267_Setup.exe)[/url]

1) Bkav Pro W32.AIDetectMalware
2) DeepInstinct MALICIOUS
3) Sangfor Engine Zero Trojan.Win32.Save.a

作者: medtech1 时间: 2024-6-17 06:43

Did anyone else notice this? or know why almost every version of the xgpro application always comes up as having malware on virustotal?
The results of sandboxing show some scary stuff!

Dynamic Analysis Sandbox Detections

Yomi Hunter Sandbox:
https://vtbehaviour.commondatastorage.googleapis.com/81c3ba9e7b008d0bb83d9857384dd59c997dc79779c018ffdf0abfd21dcb572c_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1718578535&Signature=Nt3TKvkLPlZWAbbNm0EatceYeXRziZ9avUG33mQCkJ606WWErc45I7WYXA4za%2FgUOLxKg02qxcLv0C5URUtf6YNa6zbNEG9bqbBYgQ7MpqkfovqbSgJx4qxl1jwqkpo2uBI%2B0SARDm73DRM%2F0R7xJECgFHl531MOlZUvV%2FcCrL2ASwEUZtrxiJYt3Cyz33uyDx3HRWPFkldBjvC4kDVjrr8wxHsy%2FBxQdweQyzEmLonOHnI7d2HF%2FEZbf4FmfNGcwfv3XK21dQwZwHSAQuqV%2Ff%2FFnf0qsJMCZ8KkjOOZLyPItpq%2FNVYFcxxW%2BxhpCTZ56cI5BfaQIyMs2sOWsnsY2Q%3D%3D&response-content-type=text%2Fhtml;

CAPE Sandbox:
https://vtbehaviour.commondatastorage.googleapis.com/81c3ba9e7b008d0bb83d9857384dd59c997dc79779c018ffdf0abfd21dcb572c_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1718578294&Signature=WZSdKxG9DzLczjzBLZoxuTYK6ZrSdS6SmAoOx%2F3J1lE2Pa7IOquxv5SPISexvxWbolbHQXSyvFA0c1Y3cdONcxcBf0qTXoSTMoeC%2F7K4CInBIzwlF1QeD%2FcwBXq5Wozorb427n%2FxZ0JWKdShHIxrPSRTPg12xox%2B%2BKv2mcbEobqfrWLFlk2uKVokzgt2QZi8RVbhOjZXACIE%2FgXOL3ZcVwjZbw2SyqJ%2F3DxTovu6fZWldxn%2Fse81aSDXZHy%2FpleK8aLwY0I4x6FJsYFk0m9JeBuALlbdfPPDf75EIV72U6k0jkSBrAFjNZHU6pmO7bKRDzi3DU9%2B0oSUgZbKQBXZHw%3D%3D&response-content-type=text%2Fhtml;

作者: Albano.Matos 时间: 2024-6-17 15:15

Did anyone else notice this? or know why almost every version of the xgpro application always comes ...
medtech1 发表于 2024-6-17 06:43

Hello, it happen from time to time, with all AV, including microsoft builtin AV.
What i recommend you to do:
Report the file to the AV manufacturer, for them to evaluate the false positive event.
With files, like firmware, included in the setup, or even scanned diagrams in image form or pdf,
have this annoyance from time to time.
This time my av did not report nothing, but sometimes it does. :(

作者: Igor 时间: 2024-6-17 22:28

Now
only
1
antivirus out of
55 is working,
which
I have never
heard of.The usual
false
alarm. It may be reacting
to a self-extracting
archive.Don't pay
attention.
Or
unpack it yourself,
manually.

1) DeepInstinctMALICIOUS

作者: medtech1 时间: 2024-6-18 06:47

I scanned after extracting so the extracting part should not be affecting red flags.
It shows three red flags from vendor scanners, but sandboxing tests are showing other concerning behavours:

https://www.virustotal.com/gui/file/81c3ba9e7b008d0bb83d9857384dd59c997dc79779c018ffdf0abfd21dcb572c/behavior

图片附件: 1267.png (2024-6-18 06:45, 231.73 KB) / 下载次数 1561
http://forums.xgecu.com/attachment.php?aid=2231&k=1f3a0d6a4d238c9f290350e26ff05ddd&t=1726767146&sid=4B95lI

欢迎光临 XGecu Programmer Forums (http://forums.xgecu.com/)