How to determine if a scanner finding a virus in my email is a false positive?

Question

I have an important email to send. Unfortunately, the recipient's email server rejects it because it found a virus. Note the email has a zipped .exe file attached, the .exe is supposed to download data from the internet - this, I believe, is likely to make AV engines suspicious and perhaps be a source of false positives? The .exe file is compiled by me from C# source code I wrote and I did not write my code to be malicious.

Therefore it would seem I must now somehow either make certain that the report was indeed a false positive and - having ensured this - contact the recipient in another way, OR ensure that this was NOT a false positive and - well, perhaps in this case it is the time to nuke my system from orbit :(

I uploaded the rejected email .eml file to VirusTotal - one engine reported HEUR.ExecInMail, but well I know this without AV engines already. I uploaded the .zip to VirusTotal, one engine says Unsafe but with no further details. I uploaded the .exe to VirusTotal, the same engine still claims Unsafe and one more engine says Unsafe.AI_Score_99%. All other engines find no problems.

How do I try to determine if this is a false positive or not? I'm afraid I do not have enough skills to manually reverse engineer a dotnet binary and make certain that it is not infected.

Answer 1

I will recommend you to find another way to send the file to your friend, or you can try to encrypt the file with pgp and send the file to him, in this way probably you will by pass the AV validation, but bear in mind that the validation of the MTAs can vary from one system to another due to have different policy rules on them, and the encrypted file could be label as suspicious also.

Also you need to take into account that probably your exe file contains elements/patterns that on some AVs generates the false positive. Probably contact with the vendors and submit a false positive to them

Answer 2

How do I try to determine if this is a false positive or not?

If you are a small individual coder, this is a false positive. Downloading things from the internet will surely be caught by the heuristics on the antivirus engines. It is possible that your system was infected and is infecting the compilation, but this is very unlikely. Try to install your build environment (compiler, libraries, tools) on another computer, compile the code there and see if the antivirus keep triggering.

To avoid this, you can host your password-protected zip file somewhere (there's lots of systems to host files) and send the link and password to the client. He will download the file, extract it and run.

If his antivirus flags it as dangerous, he can either trust you and whitelist it, or don't trust you and don't run it. But he will receive the file.

Answer 3

A general answer ignoring the fact that you wrote this code

It seems like VirusTotal's hits are all heuristic or driven by machine learning rather than real virus signatures. That makes this hard to gauge. I'd wait for a few days to see if the A/V engines catch up. If a fresh scan of the .exe a week after submission doesn't have more hits, you can consider the possibility that it might be a false positive so long as you accept the risks in running it.

... but you wrote that code

You're probably fine, though there is the chance that even if you bypass your email recipient's spam gateway (say by emailing it in an encrypted archive), they'll have the same issue when trying to run it on their system.

If you obfuscated any of your code, used a packer, or otherwise tried to hide stuff, that's likely what's getting picked up by the ML. (More detail from a malware analysis perspective: Explained: Packer, Crypter, and Protector.) Consider doing it differently or (preferably) not at all.

You could consider publicly posting your code, or perhaps a trimmed-down example of that code that still trips over the same issues at VirusTotal, so that experienced malware researchers can tell you what went wrong, but keep aware that they'll be limited in what they can say: they don't want to give free evasion techniques out to the real bad guys. The ideal solution will be to advise you to write your code differently and/or for the maintainers of that FPing ML to adjust their systems thanks to your benign sample. If you go this route, be patient and respectful: your request is low priority in the face of real threats and paying customers.