Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Norton & Windows Defender detect the generated exe as infected by Heur.AdvML.B virus. #538

Open
coralexa opened this issue Aug 1, 2023 · 1 comment
Labels
question Further information is requested

Comments

@coralexa
Copy link

coralexa commented Aug 1, 2023

Hi,
I'm generating a Windows application that must be deployed in Production.
Once I try to obfuscate with ConfuserEx the executable is quarantined by Norton as a high risk threat.

These are my steps:

OS: Windows Server 2022 Standard.
Microsoft Visual Studio Enterprise 2019 Version 16.11.26

Downloaded the version "1.7.0-alpha.{height}".
Cleaned and recompiled the solution, Configuration: Release Any CPU.

My C# project targets the Frame Network 4.6.2
Recompiled, Configuration: Release Any CPU.

Started from an elevated Command:
...ConfuserEx\bin\Release\net462\ConfuserEx.exe

Loaded the project P123.crproj and hit the Protect button.

The second the confused exe is generated the Norton pops up signaling the threat.

Notes:

  1. The confused executable is properly generated if I disable Norton. And it works the same way as the original exe.
  2. I've exposed the confused file to the VirusTotal, https://www.virustotal.com/
    Their findings are also included.

Thank you kindly for any ideas!

ConfuserProject ConfuserEx2Protect Heur AdvML B VirusTotal1 VirusTotal2
@coralexa coralexa added potential-bug Something does not seem to be working triage This issue needs some initial analysis. labels Aug 1, 2023
@mkaring mkaring removed potential-bug Something does not seem to be working triage This issue needs some initial analysis. labels Aug 2, 2023
@mkaring
Copy link
Owner

mkaring commented Aug 2, 2023

Some of the protections cause issues like this. The reason is that actual malware developers use ConfuserEx every now and then. The following issue contains extensive information what protections may cause false positives: #64 (comment)

@mkaring mkaring added the question Further information is requested label Aug 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants