Windows Defender claiming OSX/Metaspoit.J exists in radare2/libr/egg/p/sc/src/armle-osx-reverse.c

[orrinjelo]

Windows Defender triggered off of this file: radare2/libr/egg/p/sc/src/armle-osx-reverse.c

I'm thinking it's some bytecode substring match it caught, not sure what specifically.

Should this be submitted to https://www.microsoft.com/en-us/wdsi/filesubmission ?

[orrinjelo]

A bit more digging around suggests that it is some substring similarities it's matching. Metasploit does this:

mov r0, #0
mov r1, #0
setreuid(0, 0)

while this egg code does this:

mov r0, #0
mov r1, #1
setreuid(0, 1)

Likely similar in nature to #19114

[trufae]

by the same rule the other 15 .c files could be considered exploits . the problem is that its the first time that an AV is reporting an assembly source file as malware.. crazy times