Skip to content

Instantly share code, notes, and snippets.

@ProIntegritate

ProIntegritate/gist:b2315f160d1f561b0ec4496c9680c28f

Last active October 19, 2021 17:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ProIntegritate/b2315f160d1f561b0ec4496c9680c28f to your computer and use it in GitHub Desktop.
Save ProIntegritate/b2315f160d1f561b0ec4496c9680c28f to your computer and use it in GitHub Desktop.
Download ZIP
Virustotal false positive for an almost empty file with almost NO functionality:
Raw
gistfile1.txt
@echo off
cls
echo The following dummy code produces a false positive on Virustotal and MS Defender also reacts because of this:
echo y | del t.vb*
echo y | del t.exe
echo ----------------------------------------
echo Decoding B64 sample...
echo TW9kdWxlIE1vZHVsZTENCiAgICBTdWIgTWFpbigpDQogICAgICAgIENvbnNvbGUuV3JpdGVMaW5lKCJUaGlzIHByb2dyYW0gZG9lcyBub3RoaW5nIGJ1dCBwcmludCB0aGlzIGxpbmUgaW4gYSBjb25zb2xlIHdpbmRvdy4iKQ0KICAgIEVuZCBTdWINCkVuZCBNb2R1bGU= > t.vb.b64
certutil -decode t.vb.b64 t.vb
echo ----------------------------------------
echo .
type t.vb
echo .
echo ----------------------------------------
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" t.vb > nul
echo Press enter to tun code.
pause
t.exe
echo ----------------------------------------
echo Upload to VT and see the results for yourself.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment