Forum Discussion
Microsoft Defender false positive and WDSI submission details page bug
Hello,
I am the developer and publisher of Pulse Launcher, a legitimate signed Windows application / Minecraft mod launcher.
I already submitted this through Microsoft Security Intelligence and also opened a Microsoft Q&A thread, but I am posting here because the WDSI submission portal itself appears to be broken for these submissions.
Related Microsoft Q&A thread:
https://learn.microsoft.com/en-us/answers/questions/5929545/microsoft-defender-false-positive-and-wdsi-submiss
There are two related issues:
1. Microsoft Defender cloud ML false positives keep appearing on public multi-engine scan results for the same signed application/product family. The Microsoft detection name changes across rescans and equivalent builds, including:
- PUA:Win32/Puwaders.C!ml
- Program:Win32/Wacapew.C!ml
- Trojan:Win32/Wacatac.B!ml
- Trojan:Win32/Wacatac.C!ml
- Trojan:Win32/Sabsik.EN.A!ml
2. Microsoft Security Intelligence submissions are visible in Submission history and show status "In progress", but opening the submission details page returns:
"The details for the submission were not found or the submission has expired."
Affected submission IDs:
- dd476efa-fc04-4f13-82cf-631bbfd145a6
- efc6514c-d700-4d6a-a7e2-67a9a83334a2
- ff8d04b7-c5fc-4a05-bd53-ee7ac5981284
File details:
- File name: pulse_launcher.exe
- SHA-256: def6059c07c3e1f4a8c5649a1bbf190d4f355ee8e8b88c55c5b404edee99ecc8
- Signer: FOP Haponiuk Mykola Viktorovych
- Certificate: GlobalSign EV Code Signing certificate
The executable is not VMProtect-packed or obfuscated. It is EV-signed. A previous Microsoft analyst response stated that the file did not meet Microsoft criteria for malware or PUA, but Microsoft cloud detections continue to appear.
Could someone route this to Microsoft Defender Security Intelligence / malware analysis, or advise how to escalate WDSI submissions that exist in history but whose details endpoint returns "not found or expired"?
Thank you.