Executable flagged as infected and blocked by MetaDefender (Vir.IT detects Trojan.Win32.MSIL_Heur.A)

[rajkumarsivanantham]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest version
• Search the existing issues.

Steps to reproduce

During a security scan of the provided executable, the file was automatically blocked by MetaDefender Core due to an infection verdict. One antivirus engine identified the file as a potential Trojan, which raises security concerns for users downloading or running this binary.

Scan Overview

Scan Engine: MetaDefender Core
Version: 5.16.1
Scan Result: ❌ BLOCKED – Infected
Reason: Infected file detected during antivirus analysis
Processing Time: ~707 ms
Workflow Rule: Kiosk Hash

Expected behavior

.

Actual behavior

.

Error details

Environment data

.

Version

10.0p2

Visuals

No response

[tgauth]

Thanks for opening an issue. Can you provide some additional info on the executable that's being flagged? For context, the Win32‑OpenSSH binaries published by Microsoft are Authenticode‑signed. Verifying the signature and sharing the exact asset and SHA256 would help us validate that the flagged file matches an official release artifact.

• name (i.e. ssh.exe for ARM64)
• source (i.e. directly from GtiHub release page)
• SHA256 hash

In addition to the kiosk hash scan, did any other scanners or workflow rules flag it?

[rajkumarsivanantham]

Unfortunately we haven't got much information or the logs from the client, this report only identified at client location.
Name: ssh.exe
Source: Github Repo - https://github.com/PowerShell/Win32-OpenSSH/releases

[tgauth]

Unfortunately we haven't got much information or the logs from the client, this report only identified at client location.

Are you able to reproduce the scan on any other machine?