Reply to thread

Message

<blockquote data-quote="Anthony Qian" data-source="post: 997845" data-attributes="member: 91446">[USER=38832]@upnorth[/USER], [USER=86910]@struppigel[/USER], [USER=83059]@MacDefender[/USER], [USER=78686]@SeriousHoax[/USER], [USER=92939]@Shadowra[/USER] :Just came across a clean sample on abuse.ch (MalwareBazaar) today: <a href="https://bazaar.abuse.ch/sample/1d25ed4dcd5e0288a76f985294154c0b65af7b785e4a60f30c6264b17a6e33f6/" target="_blank">MalwareBazaar | Browse malware samples</a> (VT link: <a href="https://www.virustotal.com/gui/file/1d25ed4dcd5e0288a76f985294154c0b65af7b785e4a60f30c6264b17a6e33f6/" target="_blank">VirusTotal</a>).This sample has a legitimate digital signature and is marked as &quot;Clean/Not malicious&quot; by Kaspersky and Microsoft.[ATTACH=full]268255[/ATTACH][ATTACH=full]268257[/ATTACH]Upon further investigation, according to the Any.run report, this sample is downloaded from the official Lenovo site (<a href="https://download.lenovo.com/pccbbs/mobiles/n32pg02w_v2_version.exe" target="_blank">https://download.lenovo.com/pccbbs/mobiles/n32pg02w_v2_version.exe</a>), so it is 100% safe to use!However, this sample is detected by F-Secure as &quot;Trojan:W32/Generic.abch!fsmind&quot;, as shown below:[ATTACH=full]268259[/ATTACH]Therefore, I think F-Secure does not perform a thorough sandbox analysis and just blocks almost all PE samples on MB/Abuse.ch.</blockquote>

[QUOTE="Anthony Qian, post: 997845, member: 91446"] [USER=38832]@upnorth[/USER], [USER=86910]@struppigel[/USER], [USER=83059]@MacDefender[/USER], [USER=78686]@SeriousHoax[/USER], [USER=92939]@Shadowra[/USER] : Just came across a clean sample on abuse.ch (MalwareBazaar) today: [URL='https://bazaar.abuse.ch/sample/1d25ed4dcd5e0288a76f985294154c0b65af7b785e4a60f30c6264b17a6e33f6/']MalwareBazaar | Browse malware samples[/URL] (VT link: [URL='https://www.virustotal.com/gui/file/1d25ed4dcd5e0288a76f985294154c0b65af7b785e4a60f30c6264b17a6e33f6/']VirusTotal[/URL]). This sample has a legitimate digital signature and is marked as "Clean/Not malicious" by Kaspersky and Microsoft. [ATTACH type="full" width="646px" alt="屏幕截图 2022-07-31 132117.png"]268255[/ATTACH] [ATTACH type="full" width="648px" alt="屏幕截图 2022-07-31 132132.png"]268257[/ATTACH] Upon further investigation, according to the Any.run report, this sample is downloaded from the official Lenovo site ([URL]https://download.lenovo.com/pccbbs/mobiles/n32pg02w_v2_version.exe[/URL]), so it is 100% safe to use! However, this sample is detected by F-Secure as "[B]Trojan:W32/Generic.abch!fsmind[/B]", as shown below: [ATTACH type="full" width="545px" alt="屏幕截图 2022-07-31 132808.png"]268259[/ATTACH] Therefore, I think F-Secure does not perform a thorough sandbox analysis and just blocks almost all PE samples on MB/Abuse.ch. [/QUOTE]

Verification