you usually check the file size, if its too small, its rarely to be a trojan/virus.
the smallest size of known trojan i'v seen is 200kb+ (thats is compressed but usually more than that size )
the actual size of this tool is only
10kb it only got this big now because of the resources icon that i added, if you delete those resources you will see the actual size of this tool
now it only got detected because of api i use, same as other injector api
most trojan inject a code to a process when executed, it uses the same injector api
thats why injectors are usually detected as trojans/virus
you can also use this to detect unusual program running in ur pc
some trojans disguised as other programs, just check the location
enjoy !
****just be careful cuz its load the modules when its checking it lol (it load and free it again), i use loadlibrary to get the handle of the module cuz i notice it detect the actual location of the module than any other method i used
****lemme know if dont like thi method, i will change it