Report False Positive

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Report False Positive

L1 Bithead

Hi team,


I am Cristian, the founder of and creator of HydraHeaders, a browser profile management app for Windows.


We launched the HydraHeaders app on the 23rd of December 2020 and as of January 5th 2020, a couple of users signaled that your scan shows our app's executable file (the exe used for running the app, not the installer) as malicious.


VirusTotal scan of installer exe: 


(False Positive) VirusTotal scan of exe file: 


Here’s the G Drive link of the installer: 


Here are some technical details of our app:

  • Development language: Python 3.6
  • Exe package builder: pyinstaller
  • Code signing certificate from Comodo
  • External files used: chromedriver and sqlite
  • Administrator install required: optional (users can install it only for their Windows user, there is no need for install for all Windows users)


And here are some useful links:


We would greatly appreciate it if you can consider solving this false positive.


Please let me know if you need further information from our end.


Best regards,

Cristian Timofte



L4 Transporter

Under review

L4 Transporter

Sample is no longer malicious

Hi @tsullivan7 


Thank you for your help.


Please note that our update (v 1.1) has been flagged as well.


Here are some useful links:

VirusTotal page:


App landing page:


Version 1.1 update download link:


Could you please consider this for removing the false-positive?

Thank you!

If your software continues getting flagged by Wildfire as malicious, it would be advisable to consider what's in the code.  Is the code digitally signed?  If not you may want to consider this to limit the false positives.  One thing Wildfire detected is the sample contacting an IP address info service via HTTP.


This is often used by malware to tailor a message or note to the compromised system in a user's language by geographic IP location. This behavior is also used often used by malware to identify sandboxes to prevent executing in a lab environment.


I've submitted it for a verdict change evaluation.



Thank you for the quick reply. 


Regarding the contacting IP, indeed, the app makes a request at every launch to our server to check for updates. The page it contacts is a simple HTML file with the latest version and the app simply reads the last version number posted on the page and if different from the current version of the app, it informs the user and asks him if he wants to update or not.


Regarding the code signing, even from the first version, we sign the code. We never ship it unsigned.

  • 5 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!