Download on company network

[Daniel-Sundae]

Hello. I love flow launcher and I am trying to download it on my company network. However, IT security emailed me and said that the SHA256 hash was flagged as malicious in the sandbox environment. They wanted me to ask why it was flagged and to validate if this is a false positive. I saw the previous post about something similar, #1815, however, has there been any update?
Best, Daniel

[jjw24]

Hi there, good to hear you are enjoying flow.

The sandbox environment they are referring to would be via VirusTotal? There are only a couple (2 or 3 from memory) VirusTotal vendors that flagged flow as malicious. I have attempted to get in contact with all them and have not gotten a response back.

I am assuming VirusTotal results here unless otherwise, these are false positives. We do not host the installer on any where else but here at GitHub, so as long as it is downloaded from the GitHub releases here, it is safe. Flow is 100% open source, so code can always be inspected.

[Daniel-Sundae]

Thank you for quick reply. I was told we use the CrowdStrike Falcon software to detect malicious software. The threat score was 81/100. Is it possible to lower or explain this?

[jjw24]

I am not sure what exactly is triggering CrowdStrike Falcon's detection, if I had to guess, due to the nature of flow which, interacts with the Windows system including updating registry key to set auto start up, starting a windows process to open file/folders/programs, loading/executing program/windows native DLLs/exes and etc, maybe the reason for the detections.

[jjw24]

Just done a scan with VirusTotal, CrowdStrike Falcon came up with no issues:

I guess it comes down to the detection engine settings. I was going to try and contact them about the false positive but the available method is for false positives returned from their engine in VirusTotal.
https://www.crowdstrike.com/contact-us/

[Daniel-Sundae]

Ok I finally got it approved. Thank you!