Possible malware in src/Microsoft.DotNet.SignTool.Tests/Resources/Crossgenned.exe
- Dominant language
- C#
- Stars
- 729
- Forks
- 397
- Avg merge
- 3d 15m
- Merged PRs (30d)
- 149
Description
- [ ] This issue is blocking
- [x] This issue is causing unreasonable pain
ClamAV reports a virus in `Crossgenned.exe`:
```
$ clamscan --verbose --debug src/Microsoft.DotNet.SignTool.Tests/Resources/Crossgenned.exe
...
LibClamAV debug: FP SIGNATURE: 486ce086c7d406b48c0b7c8e5daf70e5:1274880:Win.Malware.Aotera-10060486-0 # Name: Crossgenned.exe, Type: CL_TYPE_MSEXE
src/arcade/src/Microsoft.DotNet.SignTool.Tests/Resources/Crossgenned.exe: Win.Malware.Aotera-10060486-0 FOUND
LibClamAV debug: hashtab: Freeing hashset, elements: 9, capacity: 64
LibClamAV debug: Descriptor[3]: halting after file scan because: Virus(es) detected
LibClamAV debug: Descriptor[3]: halting after file scan because: Virus(es) detected
LibClamAV debug: cli_magic_scan: returning 1 at line 5040
LibClamAV debug: Descriptor[3]: halting after file scan because: Virus(es) detected
LibClamAV debug: Cleaning up phishcheck
LibClamAV debug: Freeing phishcheck struct
LibClamAV debug: Phishcheck cleaned up
----------- SCAN SUMMARY -----------
Known viruses: 3628065
Engine version: 1.4.6
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 1.29 MB
Data read: 1.21 MB (ratio 1.06:1)
Time: 5.579 sec (0 m 5 s)
Start Date: 2026:09:14 11:53:43
End Date: 2026:09:14 11:53:49
```
To confirm, this is a false positive, right?
Contributor guide
Research direction
Open src/Microsoft.DotNet.SignTool.Tests/Resources/Crossgenned.exe and reproduce the reported ClamAV command. Determine whether the detection is a false positive; done means the issue records a confirmed explanation and the appropriate next step for this test resource.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security, testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100