topic Re: file getting blocked (false positive) in Advanced Threat Prevention Discussions

file getting blocked (false positive)

Salathiwe — Thu, 20 Apr 2023 07:34:16 GMT

Can I get assistance on this false positive.

9a27f17d859d7f60a26030c7a0ef3698ffa0ff5ff4230963e52ab79a6a4dacdf

Virus/Win32.WGeneric.dyafjk

Unique Threat ID: 575312775
Create Time: 2023-03-15 02:43:51 (UTC)

Re: file getting blocked (false positive)

djr — Thu, 20 Apr 2023 08:08:23 GMT

I have been seeing this since 17th March on downloads of utorrent installer which appear to be legitimate

URL: llsw.download3.utorrent.com/3.6.0/utorrent.46738.installer.exe

I have raised this with our support partner.

Re: file getting blocked (false positive)

Salathiwe — Thu, 20 Apr 2023 09:51:32 GMT

Support Partner as in Palo Alto (TAC) ?

Re: file getting blocked (false positive)

djr — Thu, 20 Apr 2023 11:32:33 GMT

It has been raised with TAC via our support partner. I am not getting sensible answers yet from either.

Re: file getting blocked (false positive)

djr — Thu, 20 Apr 2023 11:51:38 GMT

I have an answer from TAC that they are confident the file I have queried is malicious. I still find that odd, but that's their assessment.

Re: file getting blocked (false positive)

ymiyashita — Fri, 21 Apr 2023 00:40:31 GMT

If you suspect that the verdict is incorrect, you can submit a verdict change request.

Reference:
- WildFire report incorrect verdict (virus false positive or false negative)
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm7KCAS

Re: file getting blocked (false positive)

djr — Fri, 21 Apr 2023 08:32:57 GMT

That is interesting. I submitted the URL of the file to wildfire and that decided it was benign. Do you know if that automatically reclassifies it, or is that just an assessment for information?

Re: file getting blocked (false positive)

ymiyashita — Mon, 24 Apr 2023 01:22:41 GMT

The WildFire verdict of the sample (9a27f17d859d7f60a26030c7a0ef3698ffa0ff5ff4230963e52ab79a6a4dacdf) is still "Malware".
Please go into the report itself and check the verdict and the hash value.

If the hash value is different, you may want to submit the sample rather than the URL.

Re: file getting blocked (false positive)

djr — Fri, 21 Apr 2023 13:11:03 GMT

Thank you for pointing that out. I find it odd that on one screen it says Benign, but if you click for details it says it is malicious. The hash does match so it seems they do believe it's bad so blocking it is the right thing to do.

Thanks again

Re: file getting blocked (false positive)

ymiyashita — Mon, 24 Apr 2023 01:28:54 GMT

Ok, thanks for checking the report.

By the way, please note that submitting the same sample or the URL of the same sample doesn't trigger the reclassification (especially, when it's uploaded to the same regional cloud), e.g. the WildFire just reuses the existing result.

If you submit a verdict change request, then the sample will be re-analyzed by the Palo Alto Networks researcher/engineer manually.