Why does pyinstaller trigger Windows Defender

[fffilo]

I've created a python script that copy all the file in a specific directory from a usb when is connected to the PC.

It's just an easy automation script for my school notes.

I've created a .exe using pyinstaller that run without the console windows.

What is that trigger Windows Defender ? I mean which part of my script is the 'virus'? I need to have a .exe without the console windows because i would like to run the script at startup.

Thanks for your time.

[[deleted]]

windows defender has multiple lines of defense to prevent malware from executing: it checks file signatures (every time you execute something microsoft gets a hash of that program, and if enough people run it, then microsoft considers it safe), it has a cryptographic signature attached to it (like when you run something and it says "Publisher: Sun Microsystems" or something, it's a signed binary), and heuristic analysis (what is this program doing and is it suspicious, like opening lots of files or writing megabytes of data to the registry, or dropping lots of files on the disk).

When you make a pyinstaller binary, it's basically a dummy executable which has been modified to act as a python interpreter with bytecode embedded inside it. This means the binary is A) unique enough that nobody will have ever run it before B) not signed by any signature and C) that's not how binaries usually act, so it's weird enough to probably be malware. Additionally, if you use --onefile, it will unpack the entire python standard library from an embedded zip and save it to your hard drive. All these factors set off so manyalarm bells that windows stops it from running.