Trojan-malware-300983-susgen appears in VirusTotal analysis

[antoniochz]

Hello, here is the Virtus Total analysis of the file:

https://github.com/akiomik/vimeo-dl/releases/download/v0.1.0/vimeo-dl_0.1.0_windows_386.tar.gz

Which indicates that it contains the MALWARE: Trojan-malware-300983-susgen, something to say about it?

https://www.virustotal.com/gui/file/4a92d6e6d7fe596b9b4404c338ad3b617c49e2728774263815d8c093e1a37dd6

[akiomik]

I've tested 0.1.0 binaries on Virus Total. The following results are not consistent and do not look reliable.

arch	virus names
windows_386	Trojan.Malware.300983.susgen, Trojan.Generic@AI.96 (RDML:NbPIWqZT4JiVipSZqgMghQ)
windows_amd64	Trojan.WinGo.Rozena
windows_arm64	not detected
darwin_amd64	not detected
darwin_arm64	not detected
linux_386	not detected
linux_amd64	not detected
linux_arm64	not detected

[akiomik]

First of all, the premise is that this release build is source code from a public repository on github, built via github actions. There is no room for my alterations here. If there is room for alteration along the way, it would be in the goreleaser or github actions I use for this build, but that seems unlikely.

Also, as a general rule, heuristic detection can be false positive. The following is a quote from the Cyclonis article.

https://www.cyclonis.com/remove-trojan-malware-300983-susgen-detection/

Heuristic detections can be very effective in identifying new and previously unknown malware that may not have a known signature. However, there is also a risk of false positives, where legitimate programs or activities may be flagged as suspicious. As a result, most anti-malware software will use a combination of heuristic analysis and signature-based detection to provide the best possible protection against malware.

Please refer to other tool issues where similar results were detected.

https://github.com/ggerganov/llama.cpp/issues/898

It's not even a false positive. That's the beauty of Virustotal. It uses a ton of different engines, some of them unreliable but in combination they give a very solid signal. So when you look at that result: that's how non-malware is supposed to look like. A ton of green "good" and one false positive. Now if you were super careful you could dig into the reason for the one false positive, if it has any merit. But generally that's a good result for a large binary file.