topic Re: VirusTotal Veredict False Positive Generic.ml in VirusTotal

VirusTotal Veredict False Positive Generic.ml

eugenio.a — Wed, 06 May 2020 15:03:13 GMT

File Hash: f4b11f2ea564bcedaef047ddc49e198261dcf764a6b0e4e4ea370e611c7fe01d

Link to Virustotal report for the file: https://www.virustotal.com/gui/file/f4b11f2ea564bcedaef047ddc49e198261dcf764a6b0e4e4ea370e611c7fe01d/details

Current VirustTotal Verdict: Generic.ml (1/71)

Description: Hi, the above is a library that we distribute with as part of our solution, we've been using this library for a while and paloalto network is the only engine reporting it as positive. We contacted the author, who denies the existence of malware and claims this to be a false positive. However, this report is undermining the reputation of our product. Can you please verify the false positive claim? Thank You!

Re: VirusTotal Veredict False Positive Generic.ml

mivaldi — Wed, 06 May 2020 23:30:21 GMT

I placed a request for FP analysis with our Malware analysts. Will let you know what we find.

Re: VirusTotal Veredict False Positive Generic.ml

mivaldi — Thu, 07 May 2020 15:32:50 GMT

The sample was found to be Benign.

Re: VirusTotal Veredict False Positive Generic.ml

eugenio.a — Thu, 07 May 2020 17:13:52 GMT

Thank you for your quick response!

I realized that we submitted the file that was "re-signed" by our company. Would you mind to perform the same action on the original "signed by the author" file? Should I submit a new request? In case you can take it from here, these are the details of it:

File Hash: a24f2a1dc8901eb3dbf2425b95d49df4cba8c080dc548077e1275e5ca5567ed5

Link to Virustotal report for the file: https://www.virustotal.com/gui/file/a24f2a1dc8901eb3dbf2425b95d49df4cba8c080dc548077e1275e5ca5567ed5/detection

Current VirustTotal Verdict: Generic.ml (1/71)

Description: This is the same library you flagged as benign, the only difference is the signature of it. Thank you again!

Re: VirusTotal Veredict False Positive Generic.ml

mivaldi — Thu, 07 May 2020 20:45:07 GMT

It is easier to track if you place a separate request, but I was able to catch this one so you don't need to.

I submitted this other sample to our malware analysts. I will let you know what we find.

Re: VirusTotal Veredict False Positive Generic.ml

mivaldi — Mon, 11 May 2020 16:50:21 GMT

Sample is now marked Benign.

Re: VirusTotal Veredict False Positive Generic.ml

eugenio.a — Mon, 11 May 2020 19:58:43 GMT

Thank you!