A blank Win64 program is detected accessing several IPs. Is this normal?

[gasensor]

A blank Win64 program. There is no feature at all. There is only one default blank form. (console application Same performance)

However, this app has been detected to access several of the following IPs.

I'm confused.

I am Linux Cross to Win64.

IP List:

TCP 20.99.133.109:443
TCP 23.216.81.152:80 (www.microsoft.com [info form virustotal.com] )
TCP 131.253.33.203:80
UDP 192.168.0.74:137

This information is from : https://www.virustotal.com

FPC 3.2.2
Lazarus 2.2.6
OS: LinuxMX23.3 X86


P.S.
This also explains why my website keeps being scanned by IPs from United States Seattle.

[MarkMLl]

Duplicates https://forum.lazarus.freepascal.org/index.php?topic=65198.0

MarkMLl

[Mr.Madguy]

I guess, Virustotal dectects all network activity on virtual machine, including completely unrelated to application being examined.

[Thaddy]

A blank project does not contain any networking code.(unless sockets is used anywhere, which isn't the case).
If that is not the case it is a REAL infection. And many other executables on your computer may be affected.
(although code compiled with the fpc compiler on windows often gives false positives, because some virus "expert" fails to add an exception in their heuristics)
just complain and keep complaining in that case. Not here, but at the so called virus experts websites.
I have the time to complain, and I do that all the time...
btw virus total is a bit... well... history. You are really better off with just MS defender,
It is a market that has lost its purpose after MS defender matured. That is for private computing of course, not public entities.

[CCRDude]

The duplicate post mentions an important thing: injected code.

Any process could "use" network activity, if injected code does. In that linked post, it seems to be a WMI tool designed to monitor performance, so it might even be legit. And that such a tool communicates with Microsoft seems to be expected.

That's the downside of behaviour analysis compared to static analysis.

[gasensor]

This also explains why my website keeps being scanned by IPs from United States Seattle.

Could it be that Microsoft invested in Lazarus/Freepascal?

I'll retest later in a clean environment.

[MarkMLl]

I'll retest later in a clean environment.

One possible twist is that due to... well, just about /anything/ every program on your system results in e.g. some attempts at a name resolution lookup but most are explicitly whitelisted by the self-styled "malware detector".

While my main desktop systems are wired, one of those acts as a gateway for all WiFi traffic and I can easily hook into that to see what's /actually/ going on (Wireshark plus a few other things).

MarkMLl

[Mr.Madguy]

Again. If you would analyze Virustotal sandbox logs, you would notice, that it uses some sort of Windows virtual machine and that system activity is also logged. So, just don't confuse system activity with your application's activity.

[Thaddy]

(myself)A blank project does not contain any networking code.

Period.
Another thing is that on Windows, the mistaken trust in things like VirusTotal are completely unfounded. You should not use that anymore, on a client side, just use defender. The rest outputs rubbish.

Once there was a need for it, but for at least 5 years it is just a hoax.

[gasensor]

(myself)A blank project does not contain any networking code.

Period.
Another thing is that on Windows, the mistaken trust in things like VirusTotal are completely unfounded. You should not use that anymore, on a client side, just use defender. The rest outputs rubbish.

Once there was a need for it, but for at least 5 years it is just a hoax.

The environment on the Win platform is too harsh and there are too many viruses. In order to avoid being blocked, you can only be very careful.

For a software, reputation matters.

[Thaddy]

For a software, reputation matters.

Yes, indeed. It is just how you interpret reputation and with current knowledge for client side software, the reputation of virustotal is not great. I was a big fan of Avast and some others, but current knowledge says "past sell-by date".
Especially virustotal - because it uses multiple engines - causes more problems than it solves. It is almost guaranteed to cause false positives and you don't want that.
I am not alone in this, but feel free to ignore my advice.
(and you will run into unnecessary problems)
I have a headache to many, just to try and get Microsoft to keep their heuristics up-to-date. Because it is the heuristics is what causes most problems with FPC compiled software. And MS listens and is quick with updates.
Did it occur to you that defender does no longer marks a fpc compiled software as dangerous by default? That is called perseverance.(they changed the start-up code signature, most of the rest did not do that.)
Although, there is still a remark about unknown issuer, this is less relevant and happens all the time..
Using virustotal today is a self-fulfilling prophecy.

[Martin_fr]

Its often not the tool (i.e., nothing fundamentally wrong with virustotal), but the interpretation of its output.
And in that light, it is totally fine to ask about it.

Also, having people checking the tools they use, rather than blindly trusting is a good thing (or we would all be using a compromised compression lib now). And it improves reputation on the long run, because if lots of people keep an eye on it, and then decide to use it, that vouches for its trustworthiness.

[Thaddy]

I broadly agree with you, but...
Self-fulfilling prophesy.
Reputation related to the amount of demonstrable false positives...is not a good way to determine reputation.
And that is the case at hand.

Reputation in adapting the fingerprint of a compiler IS something that gives a company reputation. And, whatever you think about MS, they did just that.

I stick to my orginal answer: if there is demonstrable network traffic caused by your application and without intend, there is something else that interferes, usually not to the good.

[Martin_fr]

I stick to my orginal answer: if there is demonstrable network traffic caused by your application and without intend, there is something else that interferes, usually not to the good.

Well, yes, the something else in this case is called "Windows". And I wont argue about your judgment of it.

[Mr.Madguy]

Yeah, it's implementation problem, that Virustotal registers whole VM's activity, including OS activity, instead of registering application's activity only, because system activity can include various confusing transactions, such as connectivity checks, NTP queries, update checks, Smart Screen queries, etc., that are completely unrelated to application being examined. There are some other suspicious activities, such as rundll attempts, that can be treated by users as performed by application, while they're performed by Virustotal itself. So, Virustotal sandbox shouldn't be treated as precise tool to determine if application is clean or not.