Discussion extreme injector is flagging as malware?

[cqught.aim]

why does extreme injector flag as malware in virustotal?

 

[Plisskien]

why does extreme injector flag as malware in virustotal?

Because this injector involves executing code inside another process, one such method is manual mapping. Manual mapping essentially reconstructs the functionality of the Windows LoadLibrary mechanism without directly invoking LoadLibrary.

This approach does not have some of the limitations associated with traditional DLL injection. For example, a DLL can be injected directly from memory, making the injected payload harder to identify because it may not appear as a normally loaded module. At the same time, the injector does not need to invoke the standard LoadLibrary function.

Because of these capabilities, similar techniques are also used by malwares. For example, a simple packer or crypter can perform self-injection and execute a DLL directly from memory, potentially making detection by anti-malware software more difficult.

In other words, a significant amount of code and many techniques used for cheating in computer games are also used in malware development. Because of this overlap, detection engines may flag a completely legitimate DLL injector as malware simply because similar code or behavior has previously been associated with malicious software.

This is also one of the reasons why we manually approve files on the forum. Files that have a lot of detections may still be safe to use.