dotnet / dotnet/arcade

Possible malware in src/Microsoft.DotNet.SignTool.Tests/Resources/Crossgenned.exe

Open
#17,559 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
729
Forks
397
Avg merge
3d 15m
Merged PRs (30d)
149

Description

- [ ] This issue is blocking
- [x] This issue is causing unreasonable pain

ClamAV reports a virus in `Crossgenned.exe`:

```
$ clamscan --verbose --debug src/Microsoft.DotNet.SignTool.Tests/Resources/Crossgenned.exe
...
LibClamAV debug: FP SIGNATURE: 486ce086c7d406b48c0b7c8e5daf70e5:1274880:Win.Malware.Aotera-10060486-0 # Name: Crossgenned.exe, Type: CL_TYPE_MSEXE
src/arcade/src/Microsoft.DotNet.SignTool.Tests/Resources/Crossgenned.exe: Win.Malware.Aotera-10060486-0 FOUND
LibClamAV debug: hashtab: Freeing hashset, elements: 9, capacity: 64
LibClamAV debug: Descriptor[3]: halting after file scan because: Virus(es) detected
LibClamAV debug: Descriptor[3]: halting after file scan because: Virus(es) detected
LibClamAV debug: cli_magic_scan: returning 1 at line 5040
LibClamAV debug: Descriptor[3]: halting after file scan because: Virus(es) detected
LibClamAV debug: Cleaning up phishcheck
LibClamAV debug: Freeing phishcheck struct
LibClamAV debug: Phishcheck cleaned up

----------- SCAN SUMMARY -----------
Known viruses: 3628065
Engine version: 1.4.6
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 1.29 MB
Data read: 1.21 MB (ratio 1.06:1)
Time: 5.579 sec (0 m 5 s)
Start Date: 2026:09:14 11:53:43
End Date: 2026:09:14 11:53:49
```

To confirm, this is a false positive, right?

Contributor guide

Open the contributing guide

Research direction

Open src/Microsoft.DotNet.SignTool.Tests/Resources/Crossgenned.exe and reproduce the reported ClamAV command. Determine whether the detection is a false positive; done means the issue records a confirmed explanation and the appropriate next step for this test resource.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
security, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.