Encrypted file vs. trojan

[firbury]

I am trialling encryption software called Advanced Encryption Package Professional v. 5.51 ('AEPPRO') which creates self-extracting files.  These files have a double extension which Mcafee detects as a trojan and Mcafee then quarantines my files.  I have tried Mcafee support (five times) and sent to their labs for testing which confirms that my files are trojans and...well that's it, I don't seem to be able to tell anyone that it's not a trojan, it's a file that I created and want.  Question: is it a trojan? I don't think so as the software AEPPRO is widely available and I downloaded my trial from cnet.com.  I have successfully created the encrypted file on a USB stick and transferred it to another computer from which  have been able to open and unlock the file successsfully, but that computer has other virus protection, not Mcafee.  Has anyone else used AEPPRO and successsfully solved this issue because Mcafee don't seem to be able to.

[Peacekeeper]

Will point someone here as this is deeper than we go.

Usually when they reply you reply to that email adding False detection and name of detection.

In body email add Please review as I think this is a false detection.

I have PM'd an engineer

Message was edited by: Peacekeeper on 20/05/11 7:23:45 PM

[nownitin]

Hi,

Could you please post the sample ID here which you have submitted to McAfee.

Regards,

Nitin

[firbury]

McAfee Labs - Beaverton

Current Scan Engine Version:5400.1158

Current DAT Version:6350.0000

Thank you for your submission.

Analysis ID: 6635584

Name	Findings	Detection	Type	Extra
briony gadget helpline.pdf.exe	current detection	generic malware.ck	Trojan	no

current detection [ briony gadget helpline.pdf.exe ]

The file submitted is malware that can be detected with curred DAT files. It is recommended that you update your DAT and engine files and scan your computer again.

Regards,

McAfee Labs

[Hayton]

Malware writers use the double-extension trick to get users to click on a malicious download. If the hide-extensions flag is set - or if an initial exploit sets it - all the user sees is an innocent pdf or doc file. When the file is opened the executable runs and executes the malware. What your encryption software is producing bears all the hallmarks of malware, so if other vendors are giving the files the all-clear perhaps the McAfee testing needs to be tweaked to analyse the file contents more thoroughly.

As a test, I suggest you upload a couple of files to VirusTotal and see how many AV vendors flag them as suspect.

[firbury]

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: Briony Gadget Helpline.pdf.exe Submission date: 2011-05-20 18:17:01 (UTC) Current status: queued (#40)queuedanalysingfinished Result: 0/ 42 (0.0%)

VT Community not reviewed Safety score: -

Compact

Print results

Antivirus	Version	Last Update	Result
AhnLab-V3	2011.05.21.00	2011.05.20	-
AntiVir	7.11.8.85	2011.05.20	-
Antiy-AVL	2.0.3.7	2011.05.20	-
Avast	4.8.1351.0	2011.05.20	-
Avast5	5.0.677.0	2011.05.20	-
AVG	10.0.0.1190	2011.05.20	-
BitDefender	7.2	2011.05.20	-
CAT-QuickHeal	11.00	2011.05.20	-
ClamAV	0.97.0.0	2011.05.20	-
Commtouch	5.3.2.6	2011.05.20	-
Comodo	8772	2011.05.20	-
Emsisoft	5.1.0.5	2011.05.20	-
eSafe	7.0.17.0	2011.05.19	-
eTrust-Vet	36.1.8338	2011.05.20	-
F-Prot	4.6.2.117	2011.05.20	-
F-Secure	9.0.16440.0	2011.05.20	-
Fortinet	4.2.257.0	2011.05.20	-
GData	22	2011.05.20	-
Ikarus	T3.1.1.104.0	2011.05.20	-
Jiangmin	13.0.900	2011.05.20	-
K7AntiVirus	9.103.4693	2011.05.20	-
Kaspersky	9.0.0.837	2011.05.20	-
McAfee	5.400.0.1158	2011.05.20	-
McAfee-GW-Edition	2010.1D	2011.05.20	-
Microsoft	1.6903	2011.05.20	-
NOD32	6139	2011.05.20	-
Norman	6.07.07	2011.05.20	-
nProtect	2011-05-20.01	2011.05.20	-
Panda	10.0.3.5	2011.05.20	-
PCTools	7.0.3.5	2011.05.19	-
Prevx	3.0	2011.05.20	-
Rising	23.58.04.03	2011.05.20	-
Sophos	4.65.0	2011.05.20	-
SUPERAntiSpyware	4.40.0.1006	2011.05.20	-
Symantec	20111.1.0.186	2011.05.20	-
TheHacker	6.7.0.1.202	2011.05.20	-
TrendMicro	9.200.0.1012	2011.05.20	-
TrendMicro-HouseCall	9.200.0.1012	2011.05.20	-
VBA32	3.12.16.0	2011.05.19	-
VIPRE	9337	2011.05.20	-
ViRobot	2011.5.20.4470	2011.05.20	-
VirusBuster	13.6.365.0	2011.05.20	-

Additional information

Show all

MD5   : 36648a023061bbc026af78add696379d

SHA1  : a5fc24ad2106cd2a4e186fa8efe6e3d0cc38b703

SHA256: a2999da32ff2c5fb721c43f1aa102ba45c19596f7fb23866c2ee54e1856af46e

ssdeep: 3072:mIw/qgjMN+6k3z1E/lJfrb2+/pHMI3+vvUHOYltkeCkPpw8jvRkNiX98sRa53:mx32+J02 +/J3+kuYlnPztLXKsRm

File size : 204003 bytes

First seen: 2011-05-20 18:17:01

Last seen : 2011-05-20 18:17:01

TrID: UPX compressed Win32 Executable (39.5%) Win32 EXE Yoda's Crypter (34.3%) Win32 Executable Generic (11.0%) Win32 Dynamic Link Library (generic) (9.8%) Generic Win/DOS Executable (2.5%)

sigcheck: publisher....: InterCrypto Ltd copyright....: Copyright (C) 2010 product......: Self-Extracting (Encrypted) Module built by AEP PRO www.aeppro.com description..: sfxmodul original name: Self-Extracting (Encrypted) Module built by AEP PRO www.aeppro.com internal name: Self-Extracting (Encrypted) Module built by AEP PRO www.aeppro.com file version.: 5, 50, 13901, 6563 comments.....: n/a signers......: - signing date.: - verified.....: Unsigned

packers (F-Prot): UPX

PEInfo: PE structure information[[ basic data ]] entrypointaddress: 0x5BBE0 timedatestamp....: 0x4DBD6AE3 (Sun May 01 14:14:59 2011) machinetype......: 0x14c (I386)[[ 3 section(s) ]] name, viradd, virsiz, rawdsiz, ntropy, md5 UPX0, 0x1000, 0x3B000, 0x0, 0.00, d41d8cd98f00b204e9800998ecf8427e UPX1, 0x3C000, 0x20000, 0x1FE00, 7.93, 4a419889b9e6b117a1d673959a7f49b6 .rsrc, 0x5C000, 0x1000, 0xE00, 4.42, c0df1881ac084ab5150391e3f08fd0bf[[ 10 import(s) ]] KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess ADVAPI32.dll: FreeSid COMCTL32.dll: PropertySheetA COMDLG32.dll: GetOpenFileNameA GDI32.dll: DeleteDC ole32.dll: CoTaskMemFree OLEAUT32.dll: - SHELL32.dll: ShellExecuteA SHLWAPI.dll: PathCombineA USER32.dll: GetDC

ExifTool: file metadata CharacterSet: Unicode CodeSize: 131072 CompanyName: InterCrypto Ltd EntryPoint: 0x5bbe0 FileDescription: sfxmodul FileFlagsMask: 0x0017 FileOS: Win32 FileSize: 199 kB FileSubtype: 0 FileType: Win32 EXE FileVersion: 5, 50, 13901, 6563 FileVersionNumber: 5.50.13901.6563 ImageVersion: 0.0 InitializedDataSize: 4096 InternalName: Self-Extracting (Encrypted) Module built by AEP PRO www.aeppro.com LanguageCode: Russian LegalCopyright: Copyright (C) 2010 LinkerVersion: 8.0 MIMEType: application/octet-stream MachineType: Intel 386 or later, and compatibles OSVersion: 4.0 ObjectFileType: Unknown OriginalFilename: Self-Extracting (Encrypted) Module built by AEP PRO www.aeppro.com PEType: PE32 ProductName: Self-Extracting (Encrypted) Module built by AEP PRO www.aeppro.com ProductVersion: 1, 0, 0, 1 ProductVersionNumber: 1.0.0.1 Subsystem: Windows GUI SubsystemVersion: 4.0 TimeStamp: 2011:05:01 16:14:59+02:00 UninitializedDataSize: 241664

Symantec reputation:Suspicious.Insight

F-Secure DeepGuard:Suspicious:W32/Malware!Gemini

VT Community

0

This file has never been reviewed by any VT Community member. Be the first one to comment on it!

[Peacekeeper]

Maybe nownitin has fixed it retry detection on your pC.

[firbury]

Mcafee does not detect the creation of the encrypted file.  It is the real-time scanning that quarantines my file when I try to attach it to an email.

I must admit I don't know what the VirusTotal results (above) are telling me - there is no explanation nor summary.

The end result is that Mcafee has again deleted my file. GRRRR.

[Peacekeeper]

Best to await nownitin's comment.

Real time scanner uses same dats so unsure why will see what he says

[nownitin]

Hi firbury,

when real time scanning happens, does it show Artemis!0AAF63234E86 detection?, if that is the case Artemis detection should be resolved in another 30-45 minutes.

Detection Generic Malware.ck is also fixed and should be in in real time DATs2 in 2-3 days.

since malware writers use the double-extension trick to get users to click on a malicious download and if you still want to use these files, you can either change the file name limited to one extension only or add the file name based exclusion from the product.

Regards,

Nitin Kumar

McAfee SME