Report False Positive

[hydraproxy]

Hi team,

I am Cristian, the founder of HydraProxy.com and creator of HydraHeaders, a browser profile management app for Windows.

We launched the HydraHeaders app on the 23rd of December 2020 and as of January 5th 2020, a couple of users signaled that your scan shows our app's executable file (the exe used for running the app, not the installer) as malicious.

VirusTotal scan of installer exe: https://www.virustotal.com/gui/file/08ae48bc9de44bb4720f94e007dadf54a5195a77fd9839eb4d808d40513a1862... 

(False Positive) VirusTotal scan of exe file: https://www.virustotal.com/gui/file/0fbd26fbb6eff68a08748fdd95473e6e9880ee168f5b326a99bc1ef038a02419... 

Here’s the G Drive link of the installer: https://drive.google.com/file/d/1lWoK9JcR5S-jslO0D_kbofn0ABx7iILI/view?usp=sharing 

Here are some technical details of our app:

• Development language: Python 3.6
• Exe package builder: pyinstaller
• Code signing certificate from Comodo
• External files used: chromedriver and sqlite
• Administrator install required: optional (users can install it only for their Windows user, there is no need for install for all Windows users)

And here are some useful links:

• Our website and HydraHeaders presentation page: https://hydraproxy.com/hydraheaders/  
• Download link for our users (we host it on box.com): https://app.box.com/s/fcpkecprhbm87e6ouib5k2fgvu5huj0f 
• Softpedia listing page: https://www.softpedia.com/get/Internet/Other-Internet-Related/HydraHeaders.shtml
• AlternativeTo listing page: https://alternativeto.net/software/hydraheaders/

We would greatly appreciate it if you can consider solving this false positive.

Please let me know if you need further information from our end.

Best regards,

Cristian Timofte

HydraProxy

[tsullivan7]

Under review

[tsullivan7]

Sample is no longer malicious

[hydraproxy]

Hi @tsullivan7 

Thank you for your help.

Please note that our update (v 1.1) has been flagged as well.

Here are some useful links:

VirusTotal page: 

https://www.virustotal.com/gui/file/21bfe53702e1752e46d70f79ae303ffcef53922ffca4cd882b635b9357ea6c05...

App landing page:

https://hydraproxy.com/hydraheaders/

Version 1.1 update download link:

https://app.box.com/s/oj2hrtm2fygotzd0ffvpidsz0r7q92od

Could you please consider this for removing the false-positive?

Thank you!

[tsullivan7]

If your software continues getting flagged by Wildfire as malicious, it would be advisable to consider what's in the code.  Is the code digitally signed?  If not you may want to consider this to limit the false positives.  One thing Wildfire detected is the sample contacting an IP address info service via HTTP.

This is often used by malware to tailor a message or note to the compromised system in a user's language by geographic IP location. This behavior is also used often used by malware to identify sandboxes to prevent executing in a lab environment.

I've submitted it for a verdict change evaluation.

[hydraproxy]

Hi,

Thank you for the quick reply. 

Regarding the contacting IP, indeed, the app makes a request at every launch to our server to check for updates. The page it contacts is a simple HTML file with the latest version and the app simply reads the last version number posted on the page and if different from the current version of the app, it informs the user and asks him if he wants to update or not.

Regarding the code signing, even from the first version, we sign the code. We never ship it unsigned.