clang-cl binary build on windows_latest image is detected by Windows Defender as Trojan:Win32/Phonzy.B!ml

[dcoles]

Description

A binary generated using the clang-cl Visual Studio compiler front-end is being detected by Windows Defender as a threat (Trojan:Win32/Phonzy.B!ml) preventing artefacts containing the binary from being downloaded on platforms with Windows Defender installed.

I consider it unlikely that the binary is actually a virus/trojan given that it was built using only officially GitHub sanctioned software.

NOTE: The linked GitHub build includes the hendrikmuhs/ccache-action@v1.2 action, but I get the same result even if this action is removed from the build.yaml.

I've submitted a sample to Microsoft Security Intelligence (Submission ID: f2092a44-4b58-45bb-b6ed-071d43a9bc2a) as a potential false positive, but not received a report back yet.

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• macOS 11
• macOS 12
• macOS 13
• macOS 13 Arm64
• macOS 14
• macOS 14 Arm64
• Windows Server 2019
• Windows Server 2022

Image version and build link

Image version: windows-2022 (20240218.2.0)
Affected build: https://github.com/google/gemma.cpp/actions/runs/8034333811

Is it regression?

Unknown

Expected behavior

Binaries compiled using official GitHub images should not be detected as a virus/trojen.

Actual behavior

Generated binary is currently being detected by Windows Defender as Trojan:Win32/Phonzy.B!ml

Repro steps

1. Set up GitHub actions job using windows-latest and CMake with ClangCL toolset (Visual Studio clang-cl front-end)
2. Generate a Release build
3. Download resulting binary artefact
4. If not immediately detected as a threat by Windows Defender, upload to https://www.virustotal.com/ to check status

[dcoles]

Latest build (8034688123) is no longer being detected as a threat. 🤞 spoke too soon. 🤦

[shamil-mubarakshin]

Hey @dcoles, using security intelligence version 1.405.625.0 locally, zip file is not being detected as trojan. Settings used by Defender on virustotal are unknown, so I would suggest waiting for response from MS Security Intelligence.
I will close the issue for now. Feel free to reach out in case of further concerns.

[dcoles]

Hi @shamil-mubarakshin,

It looks like while it is no longer considering the zip-file as a whole to be a threat, when I try extracting the gemma.exe binary onto my computer Windows Defender now reports that it is Trojan:Script/WacatacB!ml. I believe this is one of Windows Defender's "heuristic" threats rather than a specific virus or trojan family.

This was using Security Intelligence version 1.405.662.0 and the gemma.exe binary from
gemma-windows-latest-windows-Release from this build.

It seems this is not an uncommon issue (there's about 300 issues across GitHub), but it's not immediately obvious what the trigger is other than using some variant of the MSVC toolchain. It might just be the scanner is particularly sensitive to binaries that haven't been encountered anywhere else before.

I think it's unlikely there's any real threat associated with the runners, but figured I should at least report it out of an abundance of caution. I do appreciate you taking the time to reply.

Sadly I didn't much feedback from MS Security Intelligence other than a stock "At this time, the submitted files do not meet our criteria for malware or potentially unwanted applications. The detection has been removed." I'll also file a feedback ticket for Microsoft Defender but I'm not terribly optimistic about getting a response as an individual.

Thanks.