Compare plugin detected as malicious by both JoeSandbox and Crowdstrike Falcon
-
I recently was prompted to auto-update Notepad++, which I did on my Windows 10 laptop. I then got a dialog informing me that the Compare plugin has been detected as not compatible with Notepad++ 8.3.3, and is disabled.
So, I went to Plugins > Plugins Admin and clicked the checkbox next to Compare, and clicked the “Install” button. I get a User Account Control dialog prompting me to execute “C:\Program Files\Notepad++\updater\gup.exe” -unzipTo “C:\Program Files\Notepad++\notepad++.exe” “C:\Program Files\Notepad++\plugins” “ComparePlugin https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip 4151fbc9778047991cf4b900363d846bda5b0d1783e5fed9eb77e4c8253ba315” which, I assume, downloads the ZIP file from the URL, extracts the DLLs and installs them.
But I found that JoeSandbox.com rates https://github.com/pnedev/compare-plugin/releases/download/v2.0.2/ComparePlugin_v2.0.2_X64.zip URL as “malicious,” matching multiple rules:
https://www.joesandbox.com/analysis/597349/0/executiveHybrid-Analysis.com also rates it as “suspicious.” So, in order to restore the old version of the plugin, I uninstall Notepad++ and re-install it from our internal IT department’s known-good repository, but I find that the approved version doesn’t have the plugin. Instead, it has the option to download the plugin. So I go through a similar process and it gives me a similar prompt with a download URL of https://github.com/pnedev/compare-plugin/releases/download/v2.0.0_npp7.7/ComparePlugin_v2.0.0_npp7.7_X64.zip
Again, both JoeSandbox and Hybrid Analysis rate this ZIP file as malicious; this time Hybrid-analysis.com comes back with a score of 100/100! (indicating a 100% confidence level):
https://www.hybrid-analysis.com/sample/c0f37cc70695cdd595432f7ec1c3b7e3e2fb509d96bd1da20e3ecea387c99f4fI was wondering if maybe the repository where the plugin is downloaded from has somehow been compromised?
-
The incompatibility is known and fixed – you just have to use the right version of the plugin for which version of Notepad++ you are running. (Notepad++ made an internal change which required updates to most plugins to regain compatibility)
There hasn’t been a compromise of the repository. I have never heard of any of the “rating” sites that never have a false positive; most of the time, when there’s a change to anything, they start rating things as “malicious” or “dangerous” for no good reason. (The algorithms such ratings use are looking for such small signatures in the binary that it can easily false-match tons of code, compared to the one malicious code that they’re really looking for.)
-
@peterjones said in Compare plugin detected as malicious by both JoeSandbox and Crowdstrike Falcon:
There hasn’t been a compromise of the repository. I have never heard of any of the “rating” sites that never have a false positive;
Thank you for your thoughtful reply and for verifying that the plugin-repository was not compromised. You’re entirely right that false positives are not uncommon. That’s why I didn’t post until 2 separate sandbox services said they had found something. And the sheer number of JoeSandbox signatures that got “hit,” as well as the overall “appearance” of its tree diagram seem unusual, at least to the untrained eye.
most of the time, when there’s a change to anything, they start rating things as “malicious” or “dangerous” for no good reason. (The algorithms such ratings use are looking for such small signatures in the binary that it can easily false-match tons of code, compared to the one malicious code that they’re really looking for.)
While it is interesting that the brand-new Compare v2.0.2 plugin got rated as “suspicious,” what’s more interesting is that the current download of the Compare v2.0.0 plugin also got rated as malicious. This, in spite of the fact that version 2.0.0 has existed for over five years, so I would’ve expected any FP rating of it to have been resolved long ago, hence my wonderment whether the current 2.0.0 download is the same as the author’s original upload.
-
@jonathandl2,
If you look closely at the heuristics, I would say the plugin is being penalized for things it was only designed to do.For example, it unpacks portable versins of sqlite3 and git2, which it needs to function; but these are flagged as potentially malicious “stowaways”:
Persistence and Installation Behavior Drops PE files Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\Desktop\extract\ComparePlugin\sqlite3.dll Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\Desktop\extract\ComparePlugin\git2.dll Source: C:\Windows\SysWOW64\7za.exe File created: C:\Users\user\Desktop\extract\ComparePlugin.dll Calls to Win32 API functions like GetModuleHandleW are basic requirements for every single Notepad++ plugin (a Win32 application par excellence). But these are all essentially untrusted, simply because they have low-level access to the system:
Contains functionality to dynamically determine API calls Source: C:\Windows\System32\rundll32.exe Code function: 8_2_00007FFBBDC91870 GetModuleHandleW,GetModuleFileNameW,PathRemoveExtensionW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, Possibly a rule set could be written that accounts for the typical behaviour of plugins. But I think it would end up being so permissive that basically everything would get a free pass.
-
@rdipardo said in Compare plugin detected as malicious by both JoeSandbox and Crowdstrike Falcon:
…it unpacks portable versins of sqlite3 and git2, which it needs to function; but these are flagged as potentially malicious “stowaways”:
Persistence and Installation Behavior
Drops PE files
Source: C:\Windows\SysWOW64\7za.exe
File created: C:\Users\user\Desktop\extract\ComparePlugin\sqlite3.dllSource: C:\Windows\SysWOW64\7za.exe
File created: C:\Users\user\Desktop\extract\ComparePlugin\git2.dllSource: C:\Windows\SysWOW64\7za.exe
File created: C:\Users\user\Desktop\extract\ComparePlugin.dllYes. It appears the sqlite3.dll and git2.dll files are the ones actually causing the Hybrid-Analysis sandbox to register the whole .zip as malicious as well. Not sure the best way to test them to verify they are good…
