+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Bought a NON-Malicious Program here, Computer says it's a virus (/showthread.php?tid=5665805)
Bought a NON-Malicious Program here, Computer says it's a virus - Ooze - Jul 9, 2017
Hello White Hats of HF
I recently bought
https://hackforums.net/showthread.php?tid=5661413
Which is not a malicious program like some Rats or Keyloggers sold here
Which is why I was surprised to me my computer pre-emptively delete the file believing it was a virus
Any chance one of you could look at the program and see if it is doing something it should not be doing.
* - wit - Jul 9, 2017
Send me a link and i will check for malicious intent.
* - Reyyzan - Jul 9, 2017
Could you send me a download link so i'll take a look at it
* - Ooze - Jul 9, 2017
Only going to send the link to one known member
I don't want to get in trouble with the owner
* - Reyyzan - Jul 9, 2017
(Jul 9, 2017 05:10 PM)Ooze Wrote: Only going to send the link to one known member
I don't want to get in trouble with the owner
See the details on my profile such as time spent and posts.
But no problem I understand, hope you'll resolve this and also hope this is just some false positives
* - wit - Jul 9, 2017
(Jul 9, 2017 05:10 PM)Ooze Wrote: Only going to send the link to one known member
I don't want to get in trouble with the owner
The service is licensed based - sharing the program for decompilation won't affect anything.
* - ɡringo - Jul 9, 2017
Run it through hybrid analysis and paste the results here if you don't want to give out the bin to people. Surely a "traffic bot" can't be doing anything suspicious unless it's the way it's packed.
https://www.hybrid-analysis.com
* - Wafflemonger - Jul 9, 2017
(Jul 9, 2017 05:13 PM)Coder1 Wrote: The service is licensed based - sharing the program for decompilation won't affect anything.
I would personally still verify with the program owner that he authorizes the decompilation of the program. Still ... it is a bot ... usually they're picked up as riskware or PUPs. Sometimes trojans depending on the bot functionality. It has automated processes that access URLs - it'll be picked up by anti-malware.
* - Ooze - Jul 9, 2017
(Jul 9, 2017 05:13 PM)ɡringo Wrote: Run it through hybrid analysis and paste the results here if you don't want to give out the bin to people. Surely a "traffic bot" can't be doing anything suspicious unless it's the way it's packed.
https://www.hybrid-analysis.com
The zip includes
3 .dll files
1 .xml files
1 .exe.config file
2 .exe files
What all do you want scanned
(Jul 9, 2017 05:14 PM)Wafflemonger Wrote: I would personally still verify with the program owner that he authorizes the decompilation of the program. Still ... it is a bot ... usually they're picked up as riskware or PUPs. Sometimes trojans depending on the bot functionality. It has automated processes that access URLs - it'll be picked up by anti-malware.
This was my concern, the only 2 TOS rules Im worried about are
1. You may not leak this program
2. You may not crack my program
SO if i only share once, and they only check for a virus, then neither of those would be broken
* - Reyyzan - Jul 9, 2017
(Jul 9, 2017 05:15 PM)Ooze Wrote: The zip includes
3 .dll files
1 .xml files
1 .exe.config file
2 .exe files
What all do you want scanned
This was my concern, the only 2 TOS rules Im worried about are
1. You may not leak this program
2. You may not crack my program
SO if i only share once, and they only check for a virus, then neither of those would be broken
I won't crack/unpack it and since it's license based how would I leak it ?
But you're right for looking at ToS, maybe you may ask the dev
* - Ooze - Jul 9, 2017
Hmmm ran fine in my vmbox
But would not run in a sandbox
* - PvPPrincipal - Jul 9, 2017
(Jul 9, 2017 06:04 PM)Ooze Wrote: Hmmm ran fine in my vmbox
But would not run in a sandbox
could be anti-sandboxie
* - 5chn4pp - Jul 10, 2017
I can check this file for you, I'm probably the only one here who knows malware best.
The program has anti-debugging features that detects the following: burp, wireshark, ettercap, dsniff, ethereal, tcpdump, ettercap, sandboxie.
Dispite that, I'm 98% sure that this program is clean, I've seen multiple HF users use the same program and none of then had malicious FRST entries.
The program is also packed with upx so the detections can be explained.
For now, you can consider the file as clean, I will continue doing a bit more debugging on it to fully make sure.
EDIT: program is officially clean.