Skip to content

Norton & Windows Defender detect the generated exe as infected by Heur.AdvML.B virus. #538

@coralexa

Description

@coralexa

Hi,
I'm generating a Windows application that must be deployed in Production.
Once I try to obfuscate with ConfuserEx the executable is quarantined by Norton as a high risk threat.

These are my steps:

OS: Windows Server 2022 Standard.
Microsoft Visual Studio Enterprise 2019 Version 16.11.26

Downloaded the version "1.7.0-alpha.{height}".
Cleaned and recompiled the solution, Configuration: Release Any CPU.

My C# project targets the Frame Network 4.6.2
Recompiled, Configuration: Release Any CPU.

Started from an elevated Command:
...ConfuserEx\bin\Release\net462\ConfuserEx.exe

Loaded the project P123.crproj and hit the Protect button.

The second the confused exe is generated the Norton pops up signaling the threat.

Notes:

  1. The confused executable is properly generated if I disable Norton. And it works the same way as the original exe.
  2. I've exposed the confused file to the VirusTotal, https://www.virustotal.com/
    Their findings are also included.

Thank you kindly for any ideas!

ConfuserProject ConfuserEx2Protect Heur AdvML B VirusTotal1 VirusTotal2

Metadata

Metadata

Assignees

No one assigned

    Labels

    questionFurther information is requested

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions