Bitdefender detects trojan in the .jar file

[jkiller295]

I downloaded the JMusicBot-0.3.6.jar file from the release page, and Bitdefender immediately detects a Trojan in the file

What could trigger this alert?

[MichailiK]

Disable Bitdefender or exclude JMusicBot from Bitdefender.

We don't (and probably can't) know why Bitdefender is flagging the bot as malicious.

[hermitoff]

I simply put this here : https://www.virustotal.com/gui/file/1dcdddb0e0030be8d5652718d7d3980e41e29a7b4c8ddc3f0680771144bf7749

[jkiller295]

The strange thing is when I used virustotal with the direct link of the .jar file, it couldn't detect anything; but after downloading it and uploading to virustotal, I got the same result as your link

[samhwang]

My findings are:

• Chromium Edge on Windows also blocks it from being downloaded but Chrome does it fine. Also Chromium Edge on Mac doesn't flag the file as well.
• But when I downloaded the file, I couldn't get any errors from scanning the jar file in Windows Defender.

Screenshot when I downloaded the Jar file on Chromium Edge on Windows 10:

[MichailiK]

I've submitted JMusicBot-0.3.6.jar (SHA-256 1dcdddb0e0030be8d5652718d7d3980e41e29a7b4c8ddc3f0680771144bf7749) as a false-positive to Bitdefender, hoping to get JMusicBot unflagged.

[jkiller295]

I've submitted JMusicBot-0.3.6.jar (SHA-256 1dcdddb0e0030be8d5652718d7d3980e41e29a7b4c8ddc3f0680771144bf7749) as a false-positive to Bitdefender, hoping to get JMusicBot unflagged.

Please inform when Bitdefender approves your submission. I'd like to use your bot.

[samhwang]

Also scanned this repo via Snyk, I found this error in the logback core module. But I think it's not related to the reported Trojan above?

https://snyk.io/vuln/SNYK-JAVA-CHQOSLOGBACK-1726923

[MichailiK]

We use logback for logs in JMusicBot. One of logback's features is to send logs over the internet. Because all logging happens locally, this vulnerability does not affect JMusicBot.

[Sanduhr32]

I believe logback 1.3.2 has this fixed

[MichailiK]

I've contacted Bitdefender and it looks like they (among almost all other AVs that have flagged JMusicBot) have updated their signatures to no longer falsely detect JMusicBot as malicious software.

[jkiller295]

I can confirm Bitdefender no longer flags the .jar file as a Trojan. However, MS Edge still gives you warning "This file might harm blah blah" on download

[jagrosh]

I would assume that message would be standard for downloading any executable jar file

[YJSoft]

@jkiller295 I think that message is generated based on MS's SmartScreen Reputation. since reputation is based on code sign certificate's id(which is very expensive), that will unlikely to solved itself. Anyone willing download jar file can bypass that message by pressing continue.

[MichailiK]

@jkiller295 I think that message is generated based on MS's SmartScreen Reputation.

This is false. Looking at Chromium source code, all .jar files are flagged as Dangerous and trigger a "This file might harm your computer" warning.

See:

• https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/resources/safe_browsing/README.md
• https://source.chromium.org/chromium/chromium/src/+/main:components/safe_browsing/content/resources/download_file_types.asciipb;l=743, lines 742-755