This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mal/Dropper-O - App from Windows App Store

Hello,

We are having issues with Sophos and it detecting an application downloaded from the Windows App Store. We would like to know why this is happening.

The application is called Complete Anatomy developed by 3D4Medical. We have submitted the .exe file that's causing the issue (twice) and have yet to receive a response.

Could you please explain to us what this threat means and how can we rectify it to be compatible with Sophos products?

Please see the screenshot below.

https://gyazo.com/f905e636ebca17f866c56d0568061800

This thread was automatically locked due to age.

0 PeterM over 6 years ago

Hi Aaron,

Can you confirm the name of the file you submitted so I can find it on our system please.
Cancel
Vote Up 0 Vote Down

Cancel
0 Aaron Kane over 6 years ago in reply to PeterM

Hi Peter,

The name of the file was - 3D4Medical.comLLC.CompleteAnatomy.exe

It is being identified as Mal/Dropper-O even when we open the folder of the file.
Cancel
Vote Up 0 Vote Down

Cancel
0 PeterM over 6 years ago in reply to Aaron Kane

Thanks I have found it. I can see we are indeed detecting it as are a couple other AV vendors. We are looking into exactly why it gets detected at the moment. I will let you know if we think this detection is incorrect.
Cancel
Vote Up 0 Vote Down

Cancel
0 PeterM over 6 years ago in reply to Aaron Kane

Hi Aaron,

We have now confirmed the detection is incorrect. The file is not malicious and an update to stop it being detected will go out shortly (probably next 6 hours). Thank you for bringing it to our attention.
Cancel
Vote Up 0 Vote Down

Cancel
0 Aaron Kane over 6 years ago in reply to PeterM

Hello,

We are still having the same issue with Sophos Antivirus. The application is still being detected as malware which it is not.

Can you please confirm if the application has been whitelisted?
Cancel
Vote Up 0 Vote Down

Cancel
0 PeterM over 6 years ago in reply to Aaron Kane

Aaron,

we whitelisted this file https://www.virustotal.com/#/file/7237f5718828523144665e46255dd4201c0de47bb473b68c3b609a48543690b9/detection

which is the one you sent us.

If you are still seeing files detected try uploading them to virustotal.com first and see if it is this same file (hashes need to match).
Cancel
Vote Up 0 Vote Down

Cancel
0 iStoney over 6 years ago in reply to PeterM
Hi Peter, it is still being flagged as a threat for me also. The home console labels it as: Mal/Dropper-O Threat partially cleaned

I uploaded "3D4Medical.comLLC.CompleteAnatomy.exe" to virustotal and it did have a different hash to your link above. It still returned a green tick for Sophos, though I'm not sure if Sophos Home AV engine is identical with the Sophos on this site.

Clicking the link you posted above shows 2 vendors detecting it negatively as below:

Cylance - Unsafe

TrendMicro-HouseCall - Suspicious_GEN.F47V0112

However with my sample Symantec also detected it:

Cylance - Unsafe

TrendMicro-HouseCall - PAK_Generic.007

Symantec - Trojan.Carberp.B

https://www.virustotal.com/#/file/4654ee741d79b0cd310b697f7f8db134ad525c63b772f3659434a764ab5430a2/detection

Hope this may help
Cancel
Vote Up 0 Vote Down

Cancel
0 PeterM over 6 years ago in reply to iStoney

Can you take a screenshot or copy and paste the detection you are getting, does it give details of exactly what file and it's location is being detected?

The VT link you provide shows a file that does not look like it is being detected by us.
Cancel
Vote Up 0 Vote Down

Cancel
0 iStoney over 6 years ago in reply to PeterM

I just took a screen shot for you and realised that there is a number different in the file path of the alert and the current location. My folder is now named _3.4.2.0 and not _3.4.1.0 as shown in the Sophos alert, so I assume the app had an update since this detection, hence virustotal not detecting it the same. I will click Ignore to clear the alert.

Thanks for your quick reply.
Cancel
Vote Up 0 Vote Down

Cancel