Malware found in calibre-portable.exe v5.5.0

[peter0conor]

Originally Posted by ownedbycats

That's the hash for calibre-portable.exe (the launcher for the portable version), not the portable installer: https://www.virustotal.com/gui/file/...a2e8/detection

Only two engines detect it, both detections seem to be rather generic heuristic ones, and at least Bkav is known for heavy false positives.

I ran calibre-portable.exe through Hybrid Analysis. Aside from the "identified as a virus by a piece of shit masquerading as an antivirus" there isn't really much indicating malicious behaviour. If I recall correctly, the import address thing is a standard practice - otherwise you'd get errors when trying to load libraries that don't exist on your particular version of Windows.

Yes, the hash is for the launcher, not the installation file. The installation file has the correct Hash.
I'm sorry for the misunderstanding and thanks for the prompt answers.
Peter

[JSWolf]

I've never had a false positive with Calibre. Microsoft Security, and Windows 10.