Malwarebytes thinks these Matlab files are malware

Malwarebytes flagged the 4 files below from my R2020b installation. Has anyone else experienced this? Can I safely assume it's a false alarm?

C:\PROGRAM FILES\MATLAB\R2020B\BIN\WIN64\LIBMWINT16TOUINT16.DLL

C:\PROGRAM FILES\MATLAB\R2020B\BIN\WIN64\LIBMWUINT16TOINT16.DLL

C:\PROGRAM FILES\MATLAB\R2020B\BIN\WIN64\LIBMWINT16TOUINT16.DLL

C:\PROGRAM FILES\MATLAB\R2020B\BIN\WIN64\LIBMWUINT16TOINT16.DLL

[Aditya Patil]

Can you share the sha256 hashes for these files, and the output of version command? The windows syntax for sha256 is

CertUtil -hashfile <FilePath> sha256

For linux, use the sha256sum command as follows,

sha256sum <FilePath>

The hashes should be,

b8bdbba6d35032838660db48df16b4a1b63550d56b52cea620e478720d6a4f87 for libmwint16touint16.dll

and

f6db907086c2cacd59d295dd7cf92287f81a11cf20f3e7433ec07ad8c1e7f7d2 for libmwuint16toint16.dll

unless there has been changes in the file during updates, in which case, the output of version command will help.

[Matt J]

Hi @Aditya Patil,

Here they are. Do you they look okay?

SHA256 hash of C:\PROGRAM FILES\MATLAB\R2020B\BIN\WIN64\LIBMWINT16TOUINT16.DLL:
b8bdbba6d35032838660db48df16b4a1b63550d56b52cea620e478720d6a4f87
CertUtil: -hashfile command completed successfully.

SHA256 hash of C:\PROGRAM FILES\MATLAB\R2020B\BIN\WIN64\LIBMWUINT16TOINT16.DLL:
f6db907086c2cacd59d295dd7cf92287f81a11cf20f3e7433ec07ad8c1e7f7d2
CertUtil: -hashfile command completed successfully.

SHA256 hash of C:\PROGRAM FILES\MATLAB\R2020B\BIN\WIN64\LIBMWINT16TOUINT16.DLL:
b8bdbba6d35032838660db48df16b4a1b63550d56b52cea620e478720d6a4f87
CertUtil: -hashfile command completed successfully.

SHA256 hash of C:\PROGRAM FILES\MATLAB\R2020B\BIN\WIN64\LIBMWUINT16TOINT16.DLL:
f6db907086c2cacd59d295dd7cf92287f81a11cf20f3e7433ec07ad8c1e7f7d2
CertUtil: -hashfile command completed successfully.

Answer 1

[Jan]

The hash values are correct. This means, that the virus scanner produces a false alarm. You can determine this also by sending the files to malwarebytes for a detailed analysis.

By the way, the message contains the files twice, so it matters 2 files only, not 4.