5

I just wrote and compiled a Hello World program in C# (I'm using Visual Studio 2022) and when I sent the file to VirusTotal, 1 antivirus program detected the exe as unsafe (VirusTotal results of C# Hello World Program). When I rewrote the same program in C++ and sent it to VirusTotal, 4 antivirus programs detected viruses ([VirusTotal results of C++ Hello World Program). Does this indicate that the programs are indeed viruses or is it just a false positive? Also, how can I make that the program is not detected as a virus?

Improve this question
5
  • 2
    These are behavioural heuristic detections. You need to post the source code (e.g. on GitHub or Pastebin) for us to have any idea of why this was detected.
    – Polynomial
    Commented Mar 24, 2022 at 20:08
  • 1
    csoonline.com/article/3216765/…
    – nobody
    Commented Mar 25, 2022 at 0:05
  • 1
    Maybe it's getting detected because it is compiled in debug mode and that triggers some AV heuristics... Anyways, it is quite hard to say since we don't know which AVs detected it, or why, or what the actual program looks like.
    – hft
    Commented Mar 25, 2022 at 0:24
  • 3
    @Polynomial . For C# its just Console.WriteLine("Hello World"); For C++ its #include <iostream> int main() { std::cout << "Hello, World!" << std::endl; return 0; }
    – Furkan125
    Commented Mar 25, 2022 at 21:22
  • 3
    Thank you everyone for help. Building my program in Release fixed my problem.
    – Furkan125
    Commented Mar 25, 2022 at 21:36

1 Answer 1

Reset to default
1

TL;DR: Very small programs with no useful functions are often deemed malicious in automated scans because no normal functionality could be found, which could be an indication of obfuscated malicious behaviour.

It's not you. It's not the runtime you linked against. A number of antiviruses on VirusTotal are broken.

Here's an experiment I ran to prove it after chasing down yet another antivirus report of a binary infected with a virus. I wrote this program, ran it, then submitted it.

In fact I made a bit of a mistake in my previous attempt (number of data directories = 2 instead of 16) that caused the actual Windows loader to bomb so the previous hash was different and it shows new today. The vendors have had just shy of a year to fix the problem after the last time around when I bothered to report a false positive on VirusTotal, and it has not been fixed.

00000000  4d 5a 80 00 01 00 00 00  04 00 00 00 20 00 00 00  |MZ.......... ...|
00000010  80 02 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 80 00 00 00  |................|
00000040  bb 12 01 c6 47 0d 0d 89  da b4 09 cd 21 b8 03 4c  |»..ÆG...Ú´.Í!¸.L|
00000050  cd 21 48 65 6c 6c 6f 2c  20 57 6f 72 6c 64 21 00  |Í!Hello, World!.|
00000060  0a 24 cc cc cc cc cc cc  cc cc cc cc cc cc cc cc  |.$ÌÌÌÌÌÌÌÌÌÌÌÌÌÌ|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  50 45 00 00 4c 01 01 00  00 00 00 00 00 00 00 00  |PE..L...........|
00000090  00 00 00 00 e0 00 23 01  0b 01 00 00 ac 00 00 00  |....à.#.....¬...|
000000a0  00 00 00 00 00 00 00 00  00 10 00 00 00 10 00 00  |................|
000000b0  00 00 00 00 00 00 40 00  00 10 00 00 00 02 00 00  |......@.........|
000000c0  01 00 00 00 00 00 00 00  03 00 0a 00 00 00 00 00  |................|
000000d0  00 20 00 00 a0 01 00 00  00 00 00 00 02 00 00 8f  |. .. ...........|
000000e0  00 00 01 00 00 00 01 00  00 00 01 00 00 80 00 00  |................|
000000f0  00 00 00 00 10 00 00 00  00 00 00 00 00 00 00 00  |................|
00000100  1c 10 00 00 3c 00 00 00  00 00 00 00 00 00 00 00  |....<...........|
00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000150  00 00 00 00 00 00 00 00  68 10 00 00 10 00 00 00  |........h.......|
00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000170  00 00 00 00 00 00 00 00  2e 74 65 78 74 00 00 00  |.........text...|
00000180  ac 00 00 00 00 10 00 00  ac 00 00 00 00 02 00 00  |¬.......¬.......|
00000190  00 00 00 00 00 00 00 00  00 00 00 00 20 00 00 e0  |............ ..à|
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200  31 ed bb 52 00 40 00 55  53 53 55 ff 15 70 10 40  |1í»[email protected]ÿ.p.@|
00000210  00 6a 00 ff 15 68 10 40  00 cc cc cc 58 10 00 00  |.j.ÿ.h.@.ÌÌÌX...|
00000220  00 00 00 00 00 00 00 00  78 10 00 00 68 10 00 00  |........x...h...|
00000230  60 10 00 00 00 00 00 00  00 00 00 00 85 10 00 00  |`...............|
00000240  70 10 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |p...............|
00000250  00 00 00 00 00 00 00 00  90 10 00 00 00 00 00 00  |................|
00000260  9e 10 00 00 00 00 00 00  90 10 00 00 00 00 00 00  |................|
00000270  9e 10 00 00 00 00 00 00  4b 45 52 4e 45 4c 33 32  |........KERNEL32|
00000280  2e 44 4c 4c 00 55 53 45  52 33 32 2e 44 4c 4c 00  |.DLL.USER32.DLL.|
00000290  00 00 45 78 69 74 50 72  6f 63 65 73 73 00 00 00  |..ExitProcess...|
000002a0  4d 65 73 73 61 67 65 42  6f 78 41 00              |MessageBoxA.|

Offending signatures reported (sorted by report type):

TR/Crypt.XPACK.Gen by Avira (no cloud) and WithSecure

This is some kind of generic signature; seems to mean the binary is packed and therefore unscannable. But the binary isn't packed at all.

W32.AIDetectMalware by Bkav Pro

This AI has some 'splaining to do. There is no useful information in this report.

Malicious.high.ml.score by Trapmine

Considering that ml is clearly machine learning from context, this machine isn't learning very well.

Malicious (score: 99) by Cynet

Hmm; we have some kind of confidence measure. A bit of googling reveals the range is 0-100. We have somebody asking a question that references it but no answer materialized explaining it.

Generic.Malware by TEHTRIS

Ok, so this one thinks its bad but at least it admits it doesn't know why.

Unsafe by Cylance

There is no useful information in this report.

Ti!8D9B256C375F by McAfee Scanner

There is no useful information in this report. I'm not sure if that number is an internal reference number or a hash of the binary.

If you complain about checksum; look at the checksum of a C# binary compiled with dotnet; it will be zero, and this checksum is also zero. Zero checksum means don't validate the checksum (it was thought to be an impossible value for the checksum at the time the PE spec was written; it can happen now but you need a binary within 64K of the maximum size to ever get it).

This experiment should be replicatable about a dozen times. Produce new Hello, World binaries in novel ways and watch them get detected.

From the link in comments, Cylance has provided an answer.

“The sample was small. It didn’t show any bad, but it didn’t show any good either; One function programs are almost always malware; Debug builds are statistically weird; Using mingw rather than visual studio is statistically weird. The output binary is ‘odd.'”

This is straight up not acceptable. It is extremely unfair to be biased against open source compilers.

Hyrum's answer is also bad:

“On the contrary, there are very few “useful” benign files that are small, certainly too few to contradict the above experience.

This is an example of cultural bias; exposure to Unix culture would quickly reveal how wrong this opinion is. (Yes, small useful binaries exist on Windows too.)

To their credit, Cyren fixed the nonsense detection.

Croud Strike answered intelligently. I will not quote in entirety but in part:

“[W]e expose confidence values and allow customers to set their own thresholds. While in this instance our file analysis engine was arguably too aggressive, generally this behavior is by design: if a file does not look like a legitimately useful application while also exposing unusual traits, then the sound call is to prevent it from executing. Avoiding odd looking yet potentially benign objects should be a familiar concept should you have ever opened an office fridge before.

I'm not going to say I completely agree with it but there's some actual sense to this opinion.

Improve this answer
4
  • 99% of this answer is a rant, not an actual answer. And you overlooked the solution provided by the OP in the comments. I dug out the only directly applicable part and added it at the top.
    – schroeder ♦
    Commented Oct 16 at 12:05
  • 1
    @schroeder: I didn't overlook it. That's a solution that should not work but does, and so requires explanation; and it contradicts the TL;DR you added to the top. False positives are a real pest to small developers, and the AV companies need to start putting proof of work into their automated detentions.
    – Joshua
    Commented Oct 16 at 13:37
  • Also, I have evidence elsewhere that "small" is not a very good measure of the problem. Very large binaries also trip.
    – Joshua
    Commented Oct 16 at 13:44
  • Your desires for things to be different has nothing to do with what was asked. So .... rant.
    – schroeder ♦
    Commented Oct 16 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .