And what does the application actually do, what libraries does it use, and how is it packed and distributed? At some point completely innocent netcat and tcpdu

And what does the application actually do, what libraries does it use, and how is it packed and distributed? At some point completely innocent netcat and tcpdump were marked as viruses or rootkits, because they used some low-level network API.