topic Re: False Positive Submission (generic.ml) in VirusTotal

False Positive Submission (generic.ml)

andrei.ihnatsenka — Mon, 30 Oct 2017 16:02:23 GMT

Hello!

We have checked our software on VirusTotal and see false positive detection (generic.ml). "Palo Alto Networks" is the only antivirus software which detects malicious behavior in our application. Please fix the issue.
The file is available here.

File Hash: SHA-256 49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2

Link to Virustotal report for the file: https://www.virustotal.com/#/file/49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2/detection

Current VirustTotal Verdict: One engine detected this file

Actual file: link

Thank you!

Re: False Positive Submission (generic.ml)

andrei.ihnatsenka — Thu, 30 Nov 2017 07:40:54 GMT

Guys, do you have updates on this?

Re: False Positive Submission (generic.ml)

mivaldi — Fri, 01 Dec 2017 22:40:33 GMT

Submitted 49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2 for FP analysis.

If it is confirmed to be Benign, the signature will get disabled within the next 3 business days.

Re: False Positive Submission (generic.ml)

mivaldi — Mon, 04 Dec 2017 16:49:38 GMT

Sample 49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2 has been found to be Benign.

The signature will be disabled with tomorrow's Antivirus release.

Re: False Positive Submission (generic.ml)

andrei.ihnatsenka — Mon, 04 Dec 2017 16:55:41 GMT

Thank you very much!

I'm curious will the avtivirus sofware detect a new version of the same software as malicious? The new version will have new version numbers, hashes, newer signing date, etc. Do we need to submit every version of the application to be added to "white" list?

Re: False Positive Submission (generic.ml)

mivaldi — Mon, 04 Dec 2017 17:02:48 GMT

I'll submit a separate request to evaluate adding the signer of 49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2 to Palo Alto Networks' trusted signer list.

I'll let you know once I hear back from our Threat Researchers.

Re: False Positive Submission (generic.ml)

mivaldi — Wed, 06 Dec 2017 18:21:32 GMT

"BuildingLink.com, LLC" has been added to the trusted signer list.

Re: False Positive Submission (generic.ml)

andrei.ihnatsenka — Thu, 07 Dec 2017 06:52:02 GMT

Thank you very much for all your help!