topic Re: Report False Positive in VirusTotal

Report False Positive

hydraproxy — Wed, 06 Jan 2021 13:32:27 GMT

Hi team,

I am Cristian, the founder of HydraProxy.com and creator of HydraHeaders, a browser profile management app for Windows.

We launched the HydraHeaders app on the 23rd of December 2020 and as of January 5th 2020, a couple of users signaled that your scan shows our app's executable file (the exe used for running the app, not the installer) as malicious.

VirusTotal scan of installer exe: https://www.virustotal.com/gui/file/08ae48bc9de44bb4720f94e007dadf54a5195a77fd9839eb4d808d40513a1862/detection

(False Positive) VirusTotal scan of exe file: https://www.virustotal.com/gui/file/0fbd26fbb6eff68a08748fdd95473e6e9880ee168f5b326a99bc1ef038a02419/detection

Here’s the G Drive link of the installer: https://drive.google.com/file/d/1lWoK9JcR5S-jslO0D_kbofn0ABx7iILI/view?usp=sharing

Here are some technical details of our app:

Development language: Python 3.6
Exe package builder: pyinstaller
Code signing certificate from Comodo
External files used: chromedriver and sqlite
Administrator install required: optional (users can install it only for their Windows user, there is no need for install for all Windows users)

And here are some useful links:

Our website and HydraHeaders presentation page: https://hydraproxy.com/hydraheaders/
Download link for our users (we host it on box.com): https://app.box.com/s/fcpkecprhbm87e6ouib5k2fgvu5huj0f
Softpedia listing page: https://www.softpedia.com/get/Internet/Other-Internet-Related/HydraHeaders.shtml
AlternativeTo listing page: https://alternativeto.net/software/hydraheaders/

We would greatly appreciate it if you can consider solving this false positive.

Please let me know if you need further information from our end.

Best regards,

Cristian Timofte

HydraProxy

Re: Report False Positive

tsullivan7 — Wed, 06 Jan 2021 13:42:33 GMT

Under review

Re: Report False Positive

tsullivan7 — Wed, 06 Jan 2021 15:59:59 GMT

Sample is no longer malicious

Re: Report False Positive

hydraproxy — Thu, 28 Jan 2021 09:06:25 GMT

Hi @tsullivan7

Thank you for your help.

Please note that our update (v 1.1) has been flagged as well.

Here are some useful links:

VirusTotal page:

https://www.virustotal.com/gui/file/21bfe53702e1752e46d70f79ae303ffcef53922ffca4cd882b635b9357ea6c05/detection

App landing page:

https://hydraproxy.com/hydraheaders/

Version 1.1 update download link:

https://app.box.com/s/oj2hrtm2fygotzd0ffvpidsz0r7q92od

Could you please consider this for removing the false-positive?

Thank you!

Re: Report False Positive

tsullivan7 — Thu, 28 Jan 2021 14:32:02 GMT

If your software continues getting flagged by Wildfire as malicious, it would be advisable to consider what's in the code. Is the code digitally signed? If not you may want to consider this to limit the false positives. One thing Wildfire detected is the sample contacting an IP address info service via HTTP.

This is often used by malware to tailor a message or note to the compromised system in a user's language by geographic IP location. This behavior is also used often used by malware to identify sandboxes to prevent executing in a lab environment.

I've submitted it for a verdict change evaluation.

Re: Report False Positive

hydraproxy — Thu, 28 Jan 2021 14:38:33 GMT

Hi,

Thank you for the quick reply.

Regarding the contacting IP, indeed, the app makes a request at every launch to our server to check for updates. The page it contacts is a simple HTML file with the latest version and the app simply reads the last version number posted on the page and if different from the current version of the app, it informs the user and asks him if he wants to update or not.

Regarding the code signing, even from the first version, we sign the code. We never ship it unsigned.