PolyEnE_0_01 false positive about manalyze HOT 6 CLOSED

Thanks for reporting this! Could you provide some information to demonstrate what false positives are detected?

from manalyze.

I have a few EXE files to submit.
How can I upload them to you ?
WARNING some of the files are potential malwares. Do not execute them. Just see them with an hexadecimal editor to see they are not packed by PolyEnE.

from manalyze.

from manalyze.

If I cannot upload you exe files, let's think a bit :

the signature is : 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0
If this code is assembler, then it disassembles as :
60 pusha
00 00 add BYTE PTR [eax],al
e0 .byte 0xe0

This is too much generic to be a packer routine.

If this is data, 600000E0 is too generic to rely on.

By the simple fact to look at the signature, it is sure it is too much generic and generates false positives.

from manalyze.

Mail sent with attached file.

from manalyze.

from manalyze.