I have an important email to send. Unfortunately, the recipient's email server rejects it because it found a virus. Note the email has a zipped .exe file attached, the .exe is supposed to download data from the internet - this, I believe, is likely to make AV engines suspicious and perhaps be a source of false positives? The .exe file is compiled by me from C# source code I wrote and I did not write my code to be malicious.
Therefore it would seem I must now somehow either make certain that the report was indeed a false positive and - having ensured this - contact the recipient in another way, OR ensure that this was NOT a false positive and - well, perhaps in this case it is the time to nuke my system from orbit :(
I uploaded the rejected email .eml file to VirusTotal - one engine reported HEUR.ExecInMail
, but well I know this without AV engines already. I uploaded the .zip to VirusTotal, one engine says Unsafe
but with no further details. I uploaded the .exe to VirusTotal, the same engine still claims Unsafe
and one more engine says Unsafe.AI_Score_99%
. All other engines find no problems.
How do I try to determine if this is a false positive or not? I'm afraid I do not have enough skills to manually reverse engineer a dotnet binary and make certain that it is not infected.