From: Exodus
  To: Jafo
Subj: Re: Draw32 - RELEASED!
Date: 08/02/26 11:00
Base: |03fsx|08.|04BBS |09Support|01/|09Dev|07

J> Visited the website to DL DRAW32 and Windows Defender jumped all over the D
J> with a Virus warning .. Trojan:Win32/Sabsik.FL.A!ml
Trojan:Win32/Sabsik.FL.A!ml is a strong tell.

The !ml suffix means it was flagged by Microsoft's machine-learning
heuristic model, not a signature match to a known-malicious sample.
Sabsik is a generic/heuristic detection family, notorious for
false-positiving on:

    Small, unsigned, unfamiliar console executables

    Programs compiled with Free Pascal/Lazarus (uncommon compiler low
    reputation, unusual PE structure vs. typical MSVC/Delphi/PyInstaller
    binaries Defender has lots of training data on)

    Programs that do low-level console/graphics manipulation (this one
    does direct screen buffer writes, keyboard hooks via Crt, file I/O
    for image formats) — behavior patterns that overlap with what
    some legitimate-but-unusual tools and malware both do

    Unsigned executables with no reputation/telemetry history (no
    code-signing certificate, low download count) - Microsoft's
    cloud-reputation ("SmartScreen"/ML) system is much quicker to flag
    rare, unsigned binaries

This is an extremely common complaint for small hobbyist/retro-computing
tools distributed as raw .exe files, especially ANSI-art / BBS-scene
utilities like this one (TheDraw-style editor) — they're niche enough
that few users have ever run them, so Defender's cloud model has no
positive reputation signal to counterbalance the heuristic flags.

... Crime, Sex, Alcohol, Drugs... God, I love Congress!

--- Renegade v1.44/Exp
 * Origin: The Titantic BBS Telnet - ttb.rgbbs.info (21:1/144)