False positive: VBA32 on VirusTotal detects basic bootstrapper as BScope.Trojan.Penguish

[evgen-pervenenko]

Question

Hello, community

Recently, the VBA32 antivirus engine on VirusTotal has started flagging simple bootstrapper application as Trojan malware (BScope.Trojan.Penguish). Has anyone else encountered this issue, or found a reliable workaround?

VirusTotal:
https://www.virustotal.com/gui/file/f4280a68a9b6e8fa75f6f736bb46aee7f214957a29f14543a9f427f46d052d03?nocache=1

Environment:
.NET Framework: 4.6.2
WiX Toolset: 5.0.2

Example Application:

<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs"
	xmlns:bal="http://wixtoolset.org/schemas/v4/wxs/bal"
	xmlns:util="http://wixtoolset.org/schemas/v4/wxs/util">
	
	<Bundle Name="Bootstrapper" 
			Version="1.0.0.0" 
			Manufacturer="Test app" 
			UpgradeCode="06A19F6F-688C-44A6-B3D3-26F72DE50689" 
			DisableModify="no">

		<BootstrapperApplication>
			<bal:WixStandardBootstrapperApplication
				Theme="hyperlinkLicense"
				LicenseUrl="https://example.com/license.html"/>
		</BootstrapperApplication>
		
		<Variable bal:Overridable="yes" Name="Prerequisite" Value="" Type="formatted" />
		<Variable bal:Overridable="yes" Name="InstallLevel" Value="1" />

		<Chain>
	  		<MsiPackage Id="FirstInstaller" SourceFile="$(var.FirstInstaller.TargetPath)" Visible="yes" bal:PrereqPackage="yes">
				<MsiProperty Name="PREREQUISITE" Value="[Prerequisite]" />
				<MsiProperty Name="INSTALLLEVEL" Value="[InstallLevel]" />
			</MsiPackage>
			<MsiPackage Id="SecondInstaller" SourceFile="$(var.SecondInstaller.TargetPath)" Visible="yes" bal:PrereqPackage="yes">
				<MsiProperty Name="PREREQUISITE" Value="[Prerequisite]" />
				<MsiProperty Name="INSTALLLEVEL" Value="[InstallLevel]" />
			</MsiPackage>
		</Chain>
	</Bundle>
</Wix>

Open Source Maintenance Fee

• I (or an organization I'm a member of) pay the Open Source Maintenance Fee by sponsoring the wixtoolset project because I support the maintainers.

[robmen]

Sign your bundle and send it to the anti-virus company as a false positive. All the reputable anti-virus companies have ways to report them by sending your binary. But make sure it's signed first. :)

[evgen-pervenenko]

Hi, @robmen, thank you for the suggestion! We’ve actually tested both signed and unsigned versions of the bundle — unfortunately, the detection persists in both cases.