Aurora HDR.exe

cj2468

I'm getting a "Malicious behavior blocked" message using Aurora HDR.exe. However, I scanned the directory "C:\Program Files\Skylum\Aurora HDR" with no errors and I uploaded the file to https://virustotal.com/ and it passed. Any idea what's going on?

Malicious behavior blocked

8 minutes ago

Feature:

Advanced Threat Defense

Bitdefender detected potentially malicious behavior and blocked all applications involved. Detection ID: SuspiciousBehavior.FD23F2B53EA0255

Gjoksi

Hello.

You should upload and report the file as false positive to Bitdefender Labs here:

https://www.bitdefender.com/consumer/support/answer/29358/

and wait for their response.

Only they can have access to that file and tell you if it contains malware or not.

Regards.

RedsFan

Aurora HDR seems to be a picture manager, most likely its a false positif.

https://skylum.com/aurorahdr

Flexx

https://community.bitdefender.com/en/discussion/91362/aurora-hdr-exe

I can see that you have also posted the same issue on reddit also (https://www.reddit.com/r/BitDefender/comments/u605y2/malicious_behavior_blocked_message_using_aurora/)

The detection that you are seeing is based on behaviour of the application & not a signature based detection (created by malware researchers) and that is why you are unable to see any detection under virustotal.

Sending the application directly via online submission forum will not do any good since this is not the signature based detection and you will need to provide more information to malware researchers on this.

@Alexandru_BD, @Mike_BD

Can you please share the hash 8fd24db582c16b12c962c842c947949d6051180beaf5da8c70300be8c6f79eb2 with the malware research team, they will be able to download sample directly from virustotal. Additionally, I have also messaged you the sample. The malware teams needs to know that the application is getting falsely detected by advanced threat defense (behaviour blocking) and the detection needs to be removed.

Regards

Scott

@mrmirakhur incredible insights into malware, detections, etc. At times I'm amazed by your posts :)

Flexx

https://community.bitdefender.com/en/discussion/comment/308729#Comment_308729

Thanks mate :)

Well, I am interested into security stuffs, can call it a side hobby though.

Regards

Alexandru_BD

Hello guys,

I've submitted the hash to our anti-malware teams to remove detection.

Thank you once again @mrmirakhur !

Alexandru_BD

Update: It appears that the false positive was fixed on last night's update, at ~7PM RO time. An update to the latest market signatures will fix the issue.

Cheers.