strawberry-perl-5.40.0.1-64bit.msi - perlglob.exe Trojan.Win32.Imphash.TC.1c11LOCp

[ZanzaZanzara]

After/while installing strawberry-perl-5.40.0.1-64bit.msi the perlglob.exe is detected and deleted because of Trojan.Win32.Imphash.TC.1c11LOCp

---

---

[shawnlaffan]

See #205

[tarikorg]

same issue(malwarebytes) i just quarantined it for now. it might not be a false positive

[JaneX8]

MalwareBytes detects is as ShellCode: https://www.malwarebytes.com/blog/detections/trojan-shellcode.

VirusTotal also detects it:
https://www.virustotal.com/gui/file/6494440e376a6caeb8fdb3c2a38c00249b126534008fcd8f0f2efcbdf7dfb6cd

[guest20]

Trojan.Shellcode is Malwarebytes’ generic detection name for Trojans that run shellcode on affected systems in order to launch malware or download additional malware.

@tarikorg Can you elaborate on why you think malware bytes putting part of an interpreter package in the "umm, maybe it's a shell code trojan" category is not a false positive?

[Ra2-IFV]

wtf do you understand what something like "Trojan.ShellCode" type is? do you know how a interpreter works?
can you do a reproducible build from source code? can you examine the codes if it has malicious codes?
even only 8 of 72 anti virus engine reported this
damn end users...