Submission for malware analysis

Question

We are developing a desktop application and signing it with a Microsoft certificate. However, Microsoft Defender SmartScreen displays a message that the application may be malicious and prevents it from running. We sent the application to malware analysis and it successfully passed it. However, we are constantly releasing updates, and new versions of the application cause malware notifications from Microsoft Defender SmartScreen. How can We avoid these messages appearing for new versions of our application? Is this even possible, or are we forced to check every version of the application by sending it to malware analysis? How long does the certificate's reputation take to establish?

Answer 1

SmartScreen filter is different from the Microsoft Defender Anti-Malware. I believe in your previous submission, it was okay, then you don't have to re-submit it. Submit the sample of the malware is when Microsoft Defender or other Microsoft Anti-Malware products, detects it as a malware and associate a name to it. However, the SmartScreen filter is based on many factors including reputation and when many users are downloading it, then it classifies as safe. In your case, I advise you to check with local Microsoft Office in your country. Make sure you re releasing the update through a safe method and trusted website.

Answer 2

Is this an internal or external application? If you are using Defender for Endpoint the certificate and file hash updates can be added as an indicator exclusion. I believe smart screen has a high trust level for apps on the Microsoft store. You might consider publishing external apps to the MS Store. https://developer.microsoft.com/en-us/microsoft-store/

I assume you are using something like this for submission? https://www.microsoft.com/en-us/wdsi/filesubmission

Answer 3

Hello @Ivan Molyavko

Please check the next guides to certify your application with Microsoft.

https://learn.microsoft.com/en-us/windows/win32/win_cert/windows-certification-portal

Additionally, signing of drivers and applications for Windows 10 and later needs to be done using a SHAv2 certificate as SHAv1 is not anymore considered a secure signature by Microsoft.

Hope this helps with your query,

------
--If the reply is helpful, please Upvote and Accept as answer--