search

kovalensky / tmrr

A cli tool for extracting, comparing, and calculating file hashes for .torrent files compatible with the BitTorrent v2 protocol.
MIT License
33 stars 1 forks source link

Virustotal false positive #8

Closed DejayRezme closed 1 month ago

DejayRezme commented 1 month ago

Sorry, I know this is probably false alarm, but any clue why 31 of 61 vendors flag tmrr.exe as malware?

https://www.virustotal.com/gui/file/7c7d24c6b4c7bea180a6ff137846ac4ada2f4f3c76216607801bcd43ba0c197d/detection

kovalensky commented 1 month ago

When I was writing this tool I didn't know anything except PHP.

Due to its nature of being an interpreted language, I had to get creative. So I used a packer (Enigma Virtual Box), and small C code template to call the interpreter = it's not a standard behaviour.

In the first versions I wrote to Avast, they whitelisted the file, instead of heuristic analysis, so it kept false positives in the following versions. One option was to get a digital signature, but it's not worth it for a small project.

DejayRezme commented 1 month ago

Thanks for the info!