Legitimate signed .exe application is flagged as malware and blocked by Google Drive, Microsoft and virustotal
Hi, I made a small Windows app in C#, and I’m honestly losing my mind over this. The app just checks basic computer and network requirements: Windows version, RAM, CPU, free disk space, ping, packet loss, download/upload speed and whether a VPN adapter might…
Hi, I made a small Windows app in C#, and I’m honestly losing my mind over this. The app just checks basic computer and network requirements: Windows version, RAM, CPU, free disk space, ping, packet loss, download/upload speed and whether a VPN adapter might be active. At the end it creates an HTML report locally on the desktop. It doesn’t install anything, doesn’t add itself to startup, doesn’t run PowerShell, doesn’t read user files and doesn’t download or execute other programs. I also signed the EXE with a valid code signing certificate and timestamped it. The signature shows as valid. Still, Google Drive blocks the file completely and says it violates their Terms of Service. VirusTotal also shows a few generic/heuristic detections. I’m guessing the suspicious part might be that the app uses WMI, checks network adapters and uploads random bytes to a speed test endpoint to measure upload speed. From my point of view it’s completely harmless, but I understand that this might look suspicious to automated scanners. I’m not trying to bypass antivirus or hide anything. I just want to know how legitimate small developers are supposed to distribute new Windows tools without them immediately getting treated like malware. Would switching to MSI/MSIX help? Should I remove the built-in speed test? Is it just a matter of submitting false-positive reports and waiting for reputation to build? Has anyone here dealt with something similar? I can share the VirusTotal link or sanitized parts of the source code if needed. Thanks, because at this point I’m out of ideas
Collected discussion
What is “valid code signing certificate” in your opinion?
Fair question, I probably worded that badly. I meant a publicly trusted Authenticode certificate, not self-signed. Windows verifies the signature correctly, the file hash matches, and it’s timestamped, I know that doesn’t guarantee the app is safe or give it instant reputation.
then most likely it needs to build reputation (3000+ installs based on old MS forums posts)
Feels AI, but not sure
Nah, not AI, will share it later I'll be back from work, but without signature of course cuz everybody would know where I work at lol.
The upload/download test uses Cloudflare’s speed test endpoint. I also ping a company-owned VPN gateway to measure latency, packet loss and jitter, because that’s the network the users will eventually connect to.
For ping, packet loss and jitter I send 20 ICMP echo requests to a company-owned VPN gateway, since that’s the network users will eventually connect to. For upload/download I use Cloudflare’s public speed test endpoints on speed.cloudflare.com. The download test pulls a 10 MB test file, and the upload test POSTs a locally generated 3 MB random byte buffer. I run each test three times and use the median result.
THANK YOU CHATGPT — SINCERELY, EVERYONE
I guess it’s the network testing step.. what method/server are you using for ping , upload/download?
The post itself not. Their project may be but we have no real way to tell. Maybe, probably or perhaps not.
Can we have a Virustotal link? (I'm curious)
Is the speed test endpoint your own? If it is, then everything will look like an implant. Random (possibly encoded) bytes to a low rep backend.
If it's new, which it sounds like it is, then it needs time to build up a reputation as being trustworthy. This can take a LONG time.
Welcome to modern Windows dev: every new .exe is malware until proven innocent by 3,000 downloads.
It is being flagged because of what it does, some things will do that. In games the anti cheats will often trigger AV. This is why we have exclusion lists.
You can submit false positive reports to the vendors that flagged and avoid making big changes until you know what's triggering the detection. Do you have a VirusTotal link I can check?
Start stripping out anything that makes external network connections, especially the speed test component, and make that a separate application. Add one feature, sign it and see if it causes issues, then add another, sign, add another, etc. repeat. Also do you have a proper manifest setup for your application https://learn.microsoft.com/en-us/dotnet/standard/assembly/manifest
Been there. C# app, signed, Windows Defender blocked it immediately. From what I've seen, WMI + registry access + network requests together tend to trigger Defender. Your speed test does both — network requests and random data generation — that's probably why. Solution is to submit a false positive report to Microsoft. Go through their analyst review process — once they approve it, the block gets lifted.
Does it do it inside a zip file? Does it do it if compiled as DLL? Which cert authority did you use in signing it?
Heh, back at work we had some old .DLLs for some old networked machinery which were very memory-unsafe, and the build process was compiling the code, linking the code, and getting the program automatically deleted by the virus scanner. Though C# should be memory-safe by default, so that isn't it. But "random bytes" might look like trying to do some sort of mutable / reading out of memory trickery, combined with upload and download might look like downloading a payload and then exfiltrating data.
Try Azure Artifact signing
How did you determine what is doing did you sandbox it?
Could it possibly be an issue with the file's entropy? Could give that a check if you haven't already yet.
Pgp encrypt it...
This comment was deleted.