False positive for Visual Studio extension

[ionoy123]

I'm the author of this extension: https://marketplace.visualstudio.com/items?itemName=ionoy.XamarinFormsLive-18843

There is a xlserver.exe file that is a simple .NET assembly serving as a TCP server. There is nothing malicious which can be easily verified. Please remove the false positive. 

Thanks!

[bvandivier]

Please submit the following information in the order listed below so that our team can investigate your claim and change verdicts when warranted.

File Hash: <hash>

Link to Virustotal report for the file: <link>

Current VirustTotal Verdict: <verdict>

Description: <description>

Our team will update each submission to this discussion forum at the conclusion of their research into your claim.

[ionoy123]

File Hash: 6bf09b81fd56d6fdb4558018540dc5cf760c9dadc73b7c633fe76372297cc2d2

Link to Virustotal report for the file: https://www.virustotal.com/#/file/6bf09b81fd56d6fdb4558018540dc5cf760c9dadc73b7c633fe76372297cc2d2/d...

Current VirustTotal Verdict: generic.ml

Description: xlserver.exe is the file that is contained inside VSIX package, which is actually a ZIP with another extension. My client has a corporate firewall or something, that is based on VirusTotal. Out of all vendors, only Palo Alto and CrowdStrike detected it as a possible malware. It's easy to check `xlserver.exe` because it's an unobfuscated .NET assembly. There is nothing malicious inside.

[bvandivier]

Sample with hash 6bf09b81fd56d6fdb4558018540dc5cf760c9dadc73b7c633fe76372297cc2d2 has been queued for manual review.  Please allow us 24 to 48 hours to conduct a proper review and adjust verdict as appropriate.

[bvandivier]

This sample has been updated to benign.  

Resolved Time

2018-01-15T17:57:40.755004