topic Re: False Positive in Advanced Threat Prevention Discussions

False Positive

DmitryGR — Sat, 25 Jun 2022 20:57:11 GMT

Hello,

Please fix false positive detection:

https://www.virustotal.com/gui/file/5259f523e41ffa42af0753df4c020f911a585b311c3267f17703c14920a352b8?nocache=1

Thank you!

Re: False Positive

aleksandar.astardzhiev — Sun, 26 Jun 2022 19:33:41 GMT

Hi @DmitryGR ,

This is community forum, although there are a lot of Palo Alto employees here. I would expect to much visibility for your request.

If you have active Palo Alto customer support account you can follow the process of submitting a false positive

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSBCA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3aCAC

Re: False Positive

ymiyashita — Mon, 27 Jun 2022 01:27:47 GMT

Here's another knowledge base article. The false positive is due to the incorrect WildFire verdict.

- WildFire report incorrect verdict (virus false positive or false negative)
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm7KCAS

I submitted the verdict change request on behalf.

Re: False Positive

iTopVPN — Wed, 29 Jun 2022 10:20:54 GMT

Hello Palo Alto ,

Please fix false positive detection:

spdt.exe (MaxSecure, NANO-Antivirus)
Virus Total Scanning Result: https://www.virustotal.com/gui/file/4c7f8799057351033bbe782cb065b5dfeec2762afccfbb7645380913eaa3a934
File Download link: https://www.sendspace.com/file/ow4rdb

Thanks!

Re: False Positive

ymiyashita — Thu, 30 Jun 2022 00:24:25 GMT

Hi ITopVPN,

As you can see on VirusTotal, Palo Alto Networks shows it as "Undetected" e.g. WildFire verdict is benign.
MaxSecure, NANO-Antivirus are other security companies. 😉

Re: False Positive

iTopVPN — Thu, 30 Jun 2022 09:25:33 GMT

Hello Ymiyashita,

Thanks for your reply.

Sorry, I have submitted the wrong information. Please check this one:

InfoHelp.dll (Palo Alto Networks)
Virus Total Scanning Result: https://www.virustotal.com/gui/file/658f466839bc9c6b5ed38ec2710108d7bc2335e252a47d578e14390b2315d3a2
File Download link: https://www.sendspace.com/file/jg5wup

Thanks for your help.

Re: False Positive

ymiyashita — Fri, 15 Jul 2022 08:06:53 GMT

Hi ITopVPN,

Sorry for my late response. Somehow I got the email notification today.

The verdict of the sample was already fixed on July 2 PDT. It's benign now.
https://threatvault.paloaltonetworks.com/?query=658f466839bc9c6b5ed38ec2710108d7bc2335e252a47d578e14390b2315d3a2&type=

Re: False Positive

iTopVPN — Mon, 10 Apr 2023 08:36:15 GMT

Hello Palo Alto ,

Please fix false positive detection:

Virus Total Scanning Result: https://www.virustotal.com/gui/file/8783ba0cceaa8b80547f906fc6b3f6a3af07cf4a87832b26c5c75bc5b13b5ebe
File Download link: https://www.dropbox.com/s/ewj516lansfkrgk/Paloalto.zip?dl=1

Thanks!

Re: False Positive

ymiyashita — Mon, 10 Apr 2023 08:56:51 GMT

The verdict change request can be submitted on the WildFire portal.

Reference:
- WildFire report incorrect verdict (virus false positive or false negative)
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm7KCAS

I submitted it on behalf.

Re: False Positive

ymiyashita — Tue, 11 Apr 2023 06:21:57 GMT

The WildFire verdict was changed to Benign.
https://www.virustotal.com/gui/file/8783ba0cceaa8b80547f906fc6b3f6a3af07cf4a87832b26c5c75bc5b13b5ebe

Re: False Positive

iTopVPN — Thu, 13 Jun 2024 07:50:05 GMT

Hello Ymiyashita,

Our product installation file and the download link have been flagged as threat again. The download link and VirusTotal report are listed below:

Product installation file: https://download.itopvpn.com/ installer/iTopVPN_setup_Free. exe
VirusTotal report: https://www.virustotal.com/gui/file/75baa00ec0da5b086bdd2408e4fbd7ea81c32d0e1f50af97699227ba08796a85

Please kindly fix it.

I'm looking forward to hearing back from you.

Re: False Positive

iTopVPN — Fri, 14 Jun 2024 03:08:39 GMT

Hello Palo Alto,

Please fix false positive detection:

Virus Total Scanning Result: https://www.virustotal.com/gui/file/75baa00ec0da5b086bdd2408e4fbd7ea81c32d0e1f50af97699227ba08796a85
File Download link: https://download.itopvpn.com/installer/iTopVPN_setup_Free.exe

Thanks!

Re: False Positive

ymiyashita — Wed, 03 Jul 2024 01:13:56 GMT

The WildFire verdict was changed to Benign.
https://www.virustotal.com/gui/file/75baa00ec0da5b086bdd2408e4fbd7ea81c32d0e1f50af97699227ba08796a85

Re: False Positive

bysadex — Thu, 11 Jul 2024 08:35:44 GMT

Hello, our file is getting false flagged by your engine too. I couldn’t reach you via email so I found this. VT: https://www.virustotal.com/gui/file/eb3ccf806ced05f5048be6530aa0c3276a0f217d9fd5240ac180b2c48bc9ff84/detection and downloadable via: https://verify.timeless-ac.com/download/Timeless.exe

best regards

Re: False Positive

ymiyashita — Thu, 11 Jul 2024 09:28:24 GMT

Hi @bysadex,

Please kindly open a support case.

Re: False Positive

bysadex — Thu, 11 Jul 2024 09:36:00 GMT

Thanks for the answer but I get an error when opening the support page. Always that I should contact support. „An unexpected error occurred.“

Re: False Positive

ymiyashita — Thu, 11 Jul 2024 09:42:11 GMT

Can you ask another member in the same CSP account to open an admin case to fix your login issue?

Re: False Positive

bysadex — Thu, 11 Jul 2024 09:45:34 GMT

I indeed can’t create a support account because I do not own something from you. Ain’t it possible for you to fix the false positive? I even tried to email you guys but I did not receive any answer after almost 2 weeks.

Re: False Positive

ymiyashita — Fri, 12 Jul 2024 00:15:22 GMT

I see.

By the way, I can't even get the file from the URL (https://verify.timeless-ac[.]com/download/Timeless.exe). The site returns 403 Forbidden.
So, I can't verify if the file is actually "eb3ccf806ced05f5048be6530aa0c3276a0f217d9fd5240ac180b2c48bc9ff84".
As you can see on VirusTotal, some other security vendors also classified it as Malware (trojan).
And the file is not signed. Is there a way for you to prove that this the file that you developed?
https://www.virustotal.com/gui/file/eb3ccf806ced05f5048be6530aa0c3276a0f217d9fd5240ac180b2c48bc9ff84/details

Re: False Positive

bysadex — Fri, 12 Jul 2024 00:37:23 GMT

Hi, probably because of cloudflare you can’t get via wget or something. I tried via browser and it indeed works for me. The other flags we are trying to clean atm too just some AVs don’t answer via email or don’t have something like simple submission for example MaxSecure has weird submission bc their file doesn’t work to submit. I attach the file here.