Packed an AutoHotkey script with ahk2exe using MPress, got 13 hits on the VirusTotal online scan for the zipped result. Packed the same script with the same ahk2exe without MPress and got just 6 hits on the zipped result. Zip performed with identical 7z defaults in both cases.

Some of the virus agents associated with red flags in the first scan now come up as "Unable to process file type" in the second report. Why is this?


It’s likely the antivirus products are detecting the usage of MPress itself as a sign the file is malicious.

Executable packers create files which are usually significantly different from “normal” programs in a few ways:

  • the headers are minimised, the MPress site claims to remove standard features like debug directories and relocations.
  • executable sections have high entropy (due to compression) and usually minimal space between them (a normal PE has a lot of null bytes).
  • code sections often have read/write/execute permissions, or code is created in memory with write permissions and then executed. This allows code to be decompressed in place but is unusual (outside special cases like JIT compilers).

Other reasons antivirus programs may detect these files include:

  • they are often used by malware, and rarely used enough for vendors to worry about false positives (users can add exceptions).
  • there are few compelling reasons to use packers nowadays, as storage sizes and download speeds exceed requirements for most programs.

As for the reasons files can’t be scanned, this is vendor specific. Perhaps something about the ZIP file is unusual, and the engines are refusing to scan to avoid problems. If you supply hashes of your files it might be possible to compare them further.

  • Thanks. "The engines are refusing to scan to avoid problems": The problem of getting antivirus devs some work to do? Of all the vendors contacted, only one was interested in a hash. Feb 19 '20 at 5:24

Virustotal uses yara on the backends, that basically is a regex implementation for search patterns in files, for detect the malware. Your problems looks like probably there is an issue on their side with that particular scan. I will suggest you contact them and try to resolve the issue.

  • Thanks. What was just done (and should have done before) was to upload the raw exe (without MPress) to VT- and guess what- 12 hits, a similar result as the first scan! Zip has had a major impact somehow. Feb 17 '20 at 9:07
  • 1
    VirusTotal does not use Yara for antivirus scanning. Each engine (approx. 70 now, though some are specialised e.g. for mobile malware) does it’s own scanning in whatever proprietary way. Yara can be used by premium subscribers to match files, but this is not where detections mentioned in the question come from.
    – David
    Feb 18 '20 at 23:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.