[Malicious ?] `pdfsam-4.2.4.msi` and `PDFsam_Basic_4_Installer.exe` were detected malicious in VirusTotal

[kevinadhiguna]

Hello, I just downloaded PDF Sam Basic in .exe and .msi extensions. Next, I scanned them with VirusTotal.

The results were :

PDFsam_Basic_4_Installer.exe, retrieved from PDFsam official website

pdfsam-4.2.4.msi, retrieved from GitHub PDFsam Release v4.2.4

May I know why ? Thank you.

[torakiki]

The exe installer is sort of expected. We offer to try PDFsam Enhanced from it (it should be crystal clear from the download page and you can opt out) and for that reason few AntiVirus software flags it as PuP (Potentially unwanted program).
The MSI flagging is new to me and I think it's just a DrWeb false positive or somehow they are linking it to the .exe, not sure. Anyway, I reported it to DrWeb as false positive.
The MSI doesn't include any offer to try PDFsam Enhanced, it's just a clean installer (see https://github.com/torakiki/pdfsam/tree/master/pdfsam-basic/src/msi ) but if you still have doubts you can also use the .zip package, PDFsam Basic doesn't really need an installation, it's just a convenient way to have it in the Start menu. You can also build it yourself if you like..

[kevinadhiguna]

Thank you, I appreciate your feedback @torakiki.

[torakiki]

An update on this. It seems Dr.Web doesn't want to whitelist the MSI, not sure why, they didn't provide any information and they didn't answer to my second email, there isn't much more I can do.

Hello,
I personally built the MSI, the scripts are open source available here https://github.com/torakiki/pdfsam/tree/master/pdfsam-basic/src/msi and I'm quite sure I didn't bundle anything into the MSI.. and the other 50 antivirus agree with me. Can you please clarify what is the potentially unwanted program?
Thanks
Andrea

---

Sober Lemur S.a.s. di Vacondio Andrea
soberlemur.com

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
Il martedì 4 maggio 2021 14:18, Virus Monitoring Service Doctor Web Ltd. <...> ha scritto:

Greetings,

Your request has been analyzed. This is not a false positive.

Thank you for the cooperation.

Чтобы получать оповещения на русском языке, отправьте пустое сообщение на адрес ...

---

Yours sincerely,
Virus Monitoring Service
Doctor Web Ltd.

Category: FALSE ALARM LINK
-------------------Request-------------------------------------

Hello,

User sent us a suspicious file.
...
...
User comment: I see from VirusTotal that your software is flagging our open source MSI installer as program unwanted but there is no PuP in the MSI.
https://www.virustotal.com/gui/file/f96d90f457ef138a6dd4bea797a29fc28614fe9c866f1362d52a5095e7200c88/detection
https://github.com/torakiki/pdfsam/releases/download/v4.2.4/pdfsam-4.2.4.msi
...

[torakiki]

So.. this was bothering me and I made a quick test, I downloaded Dr. Web installer called drweb-1.0-katana.exe and signed it with our certificates:

I ran it into VirusTotal voilà, now also Dr. Web has a ProgramUnwanted:
https://www.virustotal.com/gui/file/ed156afec519a815bf78ed7a1725aa676fb2782a2b77fb336b3d0e7962276a34

So it seems it's our certificate to trigger the false positive, not the actual content of the file, everything we sign is flagged, no matter what.