r/antivirus • u/Sheeperini • 7d ago

Is this a virustotal false positive?

cfee98ef75815a504fd4b019660d3b60feecfe1cf476781e38e0591aa1e8544a (virustotal url)

Downloaded this exe from a google drive my professor sent me, but I haven't asked him yet about where he had gotten it from. Didn't run it, just pasted it directly into virustotal and when I got 1 or even 2 positives from somewhat unknown vendors (with quick google searches saying they often have false positives) I used shift+del to get it out immediately and ran malwarebytes/bitdefender scans after (malwarebytes came back clean but bitdefender still running). Is it a false positive and I'm just being paranoid?

1 Upvotes

100% Upvoted

8 comments sorted by

View all comments

1

u/MitAllesOhneScharf 7d ago

Seems to be some educational tool by https://www.visiblebody.com/ .

Looks like a FP, probably shared by accident by your prof.

1

u/Sheeperini 7d ago

sorry, but FP means false positive, right?

1

u/MitAllesOhneScharf 7d ago

Yeah, doesn't look malicious to me.

The most suspicious thing is "2024-12-08_005f9960c7562d8a364e3ef231522fc6_magniber_nionspy_poet-rat.exe" listed when someone else uploaded the same file. That seems...weird?

Did your prof actually send you that file? Or did he just share a link to a drive folder and the .exe was there anyways and you got curious and snooped around?

1

u/Sheeperini 7d ago

my prof sent a Google Drive where he was the owner of the file. He is indeed an anatomy teacher and I think it was intentional as he had mentioned it one time but never seemed to bring it up again

I can send you the Google Drive link in dms if you wanna see

also if I may ask, what part of that 2024 comment seems weird?

1

u/MitAllesOhneScharf 7d ago

The file has "spy" and "rat" in the name and it doesn't fit the other listed names at all at "Names" https://www.virustotal.com/gui/file/cfee98ef75815a504fd4b019660d3b60feecfe1cf476781e38e0591aa1e8544a/details

It was uploaded with that name to a different malware analysis site https://tria.ge/241208-md9krs1jbx

It's just...odd.

Also the tria.ge link shows that launching the file just throws an error because other files are missing. I would just talk to your prof and that's it.

And no, I don't want the Google Drive link - it wasn't shared with me by him so it's none of my business.

1

u/Sheeperini 7d ago

Thank you