topic Re: VirusTotal False Positive: Internal App in VirusTotal

VirusTotal False Positive: Internal App

EngA_DerekBannard — Tue, 20 Aug 2019 17:39:40 GMT

I would like to submit the following information so that your team can investigate and change verdicts when warranted.

File Hash: [UTM/VirusTotal]

File Digest: 5fe238f2a8d7ce601370d18f18764eab274fb3397826c9fa48c65ef04a72408d

Link to Virustotal report for the file: https://www.virustotal.com/gui/file/5fe238f2a8d7ce601370d18f18764eab274fb3397826c9fa48c65ef04a72408d/detection

Current VirustTotal Verdict: Generic.ml

Current UTM Verdict: malicious

Description: This is an internally created application that is used by our office workers. This EXE is being flagged by our Palo UTM as "malicious" and listed on VirusTotal as "Generic.ml".

Re: VirusTotal False Positive: Internal App

dparris — Tue, 20 Aug 2019 17:47:59 GMT

As a Palo Alto Customer,

Please open a support case for this.

Re: VirusTotal False Positive: Internal App

EngA_DerekBannard — Tue, 20 Aug 2019 17:55:11 GMT

Is there a reason a posting in this forum is no longer accepted to report a false positive, with all the requested information in the "sticky" detailing what to include?

Re: VirusTotal False Positive: Internal App

dparris — Tue, 20 Aug 2019 18:06:26 GMT

As a Palo Alto customer you are entitled to support, here we only look at requests and flip the verdict if or when necessary.

As Palo Alto customer we can look into why you are getting possible false positives and into other means of fixing the issue.

This has never been the method for Palo Alto Customers to report false positives.

This is the method for those that are not our customers and have no other means of reporting a malicious verdict.

Re: VirusTotal False Positive: Internal App

EngA_DerekBannard — Tue, 20 Aug 2019 19:03:06 GMT

Understood, and thank you for the clarification.