topic Re: False Positive Report generic.ml in VirusTotal

False Positive Report generic.ml

installer — Tue, 24 Oct 2017 20:37:52 GMT

File Hash: d98c8d61a76bfa26426aec9dbb28f7bf6d24e4769d4f612c86428b33caf0c8b1

Link to Virustotal report for the file:

https://www.virustotal.com/#/file/d98c8d61a76bfa26426aec9dbb28f7bf6d24e4769d4f612c86428b33caf0c8b1/detection

Current VirustTotal Verdict: generic.ml

Description: false positive of file "vskaze_install.exe" for "Palo Alto Networks"

The file is absolutely clean.

I am myself create this software with NSIS installer.

Re: False Positive Report generic.ml

installer — Wed, 15 Nov 2017 03:10:10 GMT

Why you ignore this request ?

Re: False Positive Report generic.ml

mivaldi — Thu, 16 Nov 2017 22:49:31 GMT

I've submitted the sample to our threat researchers to study the samples' behavior.

If it's benign, this potential FP will be corrected.

Re: False Positive Report generic.ml

installer — Sat, 25 Nov 2017 23:40:37 GMT

THX it's help but now we have new version and it also marm by Palo Alto Networks as generic.ml

https://www.virustotal.com/#/file/54c85f986e5957b0366c57e2345bd15d2f4bd9d882b6c26cd601a31bd5029113/detection

Re: False Positive Report generic.ml

mivaldi — Sun, 26 Nov 2017 01:10:52 GMT

Please provide the link to the downloadable. The new version has sha256

cf90704d5780db8ec9e1b0d58ced5eb2ea7016b64dd84b7ce18ec6a7afe7c208 and not 54c85f986e5957b0366c57e2345bd15d2f4bd9d882b6c26cd601a31bd5029113.

d98c8d61a76bfa26426aec9dbb28f7bf6d24e4769d4f612c86428b33caf0c8b1 has been analyzed and Its verdict has been changed from Malware to Benign.

Are you the developer of this application?

Re: False Positive Report generic.ml

installer — Sun, 26 Nov 2017 11:26:05 GMT

Yes i'm developer of both aplications

cf90704d5780db8ec9e1b0d58ced5eb2ea7016b64dd84b7ce18ec6a7afe7c208

and

54c85f986e5957b0366c57e2345bd15d2f4bd9d882b6c26cd601a31bd5029113

Download links for both:

54c85f986e5957b0366c57e2345bd15d2f4bd9d882b6c26cd601a31bd5029113

http://vskaze.ru/base_installer.exe

cf90704d5780db8ec9e1b0d58ced5eb2ea7016b64dd84b7ce18ec6a7afe7c208

http://vskaze.ru/updater.exe

Re: False Positive Report generic.ml

installer — Fri, 01 Dec 2017 18:00:54 GMT

We update our binary links the same sha256 is changed

And now it's both clean for "Palo Alto Networks"

But only for now, like it is for other version.

But after some days it's "generic.ml"

Why ?

Re: False Positive Report generic.ml

mivaldi — Fri, 01 Dec 2017 18:04:42 GMT

When you change your binary, the file makes it to WildFire once a WildFire subscriber submits the sample and is processed. That may take time. WildFire does not fetch all binary files from anywhere as soon as they are created.

Re: False Positive Report generic.ml

mivaldi — Fri, 01 Dec 2017 18:20:29 GMT

I submitted both samples for verdict analysis.

54c85f986e5957b0366c57e2345bd15d2f4bd9d882b6c26cd601a31bd5029113

http://vskaze.ru/base_installer.exe

cf90704d5780db8ec9e1b0d58ced5eb2ea7016b64dd84b7ce18ec6a7afe7c208

http://vskaze.ru/updater.exe

If they are found to be benign, the associated signatures will be disabled within 3 business days.

Re: False Positive Report generic.ml

installer — Sun, 03 Dec 2017 23:49:32 GMT

But as I said signatures is changed and current http://vskaze.ru/base_installer.exe is marked as "generic.ml"

https://www.virustotal.com/#/file/5710b2133fea794907593cc49da52e723d1910f83fd7190302f01e3e48552edb/detection

http://vskaze.ru/updater.exe for the time being is not marked as "generic.ml", but who knows after some days.

https://www.virustotal.com/#/file/9c295ade1631e9b74901c800b80aeb454b1f1599c475358151dee35c10e330fc/detection

Re: False Positive Report generic.ml

mivaldi — Mon, 04 Dec 2017 21:21:16 GMT

The best path for you will be to digitally sign your binaries. Once that's done we can add the signature to our list of trusted signers.

Re: False Positive Report generic.ml

mivaldi — Mon, 04 Dec 2017 21:30:00 GMT

I just heard back on:

54c85f986e5957b0366c57e2345bd15d2f4bd9d882b6c26cd601a31bd5029113 http://vskaze.ru/base_installer.exe

cf90704d5780db8ec9e1b0d58ced5eb2ea7016b64dd84b7ce18ec6a7afe7c208 http://vskaze.ru/updater.exe

Reviewers Comments:

================================================================================================
Flipping to benign to be consistent with a previous flip for this game. The game launcher could be downloading anything though, so this seems risky even if not immediately malicious.

================================================================================================

Since the samples exhibit a potentially unwanted behavior it will be hard to get you in the trusted signers list. If you're still interested let me know, I can get more details to see if there's any 'certification' path to verify you're a trusted source.

Re: False Positive Report generic.ml

installer — Fri, 26 Jan 2018 11:03:02 GMT

We can't now (early alpha phase) using Code Signing Certificate cuz it so expensive for us.

Reviewers are right, but you will not be able to implement an online game update in another way.

So please remove False Positive Report "generic.ml" again 😞

https://www.virustotal.com/#/file/9459a48553450ca7101437e14d36fc1b04cb872afd430131645d21cfdea3dece/detection

Re: False Positive Report generic.ml

mivaldi — Mon, 29 Jan 2018 18:27:17 GMT

I submitted 9459a48553450ca7101437e14d36fc1b04cb872afd430131645d21cfdea3dece for FP analysis

Re: False Positive Report generic.ml

mivaldi — Mon, 29 Jan 2018 19:00:55 GMT

9459a48553450ca7101437e14d36fc1b04cb872afd430131645d21cfdea3dece's verdict has been changed to Benign.

The associated signatures will be removed with the next release of the Antivirus database.

Re: False Positive Report generic.ml

installer — Sun, 13 Jan 2019 10:23:31 GMT

https://www.virustotal.com/#/file/625dec6977b9150ef85ee32af76c526528c568e1353b646c4d39f7878ca8c5ee/detection

Same like previous (

generic.ml

SHA-256

625dec6977b9150ef85ee32af76c526528c568e1353b646c4d39f7878ca8c5ee

Download url: http://vskaze.ru/updater.exe

Re: False Positive Report generic.ml

installer — Wed, 16 Jan 2019 12:14:42 GMT

And second file the same now: generic.ml

https://www.virustotal.com/#/file/250185558612bf9c46bac8e12c29bb59d2f7378db32826ed41cfc46555624403/detection

SHA-256: 250185558612bf9c46bac8e12c29bb59d2f7378db32826ed41cfc46555624403

Download url: http://vskaze.ru/base_installer.exe