Visited the website to DL DRAW32 and Windows Defender jumped all over the D with a Virus warning .. Trojan:Win32/Sabsik.FL.A!ml
Trojan:Win32/Sabsik.FL.A!ml is a strong tell.
The !ml suffix means it was flagged by Microsoft's machine-learning
heuristic model, not a signature match to a known-malicious sample.
Sabsik is a generic/heuristic detection family, notorious for
false-positiving on:
Small, unsigned, unfamiliar console executables
Programs compiled with Free Pascal/Lazarus (uncommon compiler low
reputation, unusual PE structure vs. typical MSVC/Delphi/PyInstaller
binaries Defender has lots of training data on)
Programs that do low-level console/graphics manipulation (this one
does direct screen buffer writes, keyboard hooks via Crt, file I/O
for image formats) — behavior patterns that overlap with what
some legitimate-but-unusual tools and malware both do
Unsigned executables with no reputation/telemetry history (no
code-signing certificate, low download count) - Microsoft's
cloud-reputation ("SmartScreen"/ML) system is much quicker to flag
rare, unsigned binaries
This is an extremely common complaint for small hobbyist/retro-computing
tools distributed as raw .exe files, especially ANSI-art / BBS-scene
utilities like this one (TheDraw-style editor) — they're niche enough
that few users have ever run them, so Defender's cloud model has no
positive reputation signal to counterbalance the heuristic flags.
... Crime, Sex, Alcohol, Drugs... God, I love Congress!
--- Renegade v1.44/Exp
* Origin: The Titantic BBS Telnet - ttb.rgbbs.info (21:1/144)
