topic False Positive in VirusTotal https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587246#M2451 <P>File Hash:<A class="text-truncate" style="text-decoration: none; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: #20242c; font-family: 'Source Sans Pro', Roboto, RobotoDraft, Helvetica, Arial, sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;" target="_blank">ca38a0493182414a3a1a5233fd4e07435247934e46cfae433defcd4a5fda8a3c</A></P> <P>&nbsp;</P> <P>Link to Virustotal report for the file:</P> <P><A href="https://www.virustotal.com/gui/file/ca38a0493182414a3a1a5233fd4e07435247934e46cfae433defcd4a5fda8a3c/details" target="_self">Link</A></P> <P>&nbsp;</P> <P>Current VirustTotal Verdict:</P> <P>Generic.ml</P> <P>&nbsp;</P> <P>Description:<BR />Good afternoon!</P> <P>&nbsp;</P> <P><SPAN>This .exe file connects to and uses only the wproxy.me domain (api.wproxy.me and files.wproxy.me)</SPAN></P> <P>&nbsp;</P> <P><SPAN>These URLs are clean:</SPAN></P> <P data-unlink="true">VirusTotal ( https://api.wproxy.me )</P> <P><A href="https://www.virustotal.com/gui/url/21fb86407f735d350c704d4f805bce52ba2fb78e40053174c6b5dbb47e932a3a?nocache=1" target="_self">Link</A>&nbsp;</P> <P data-unlink="true">VirusTotal ( https://files.wproxy.me )</P> <P><A href="https://www.virustotal.com/gui/url/5c6ac85c32d712b29a2cf2aafb7e8ddae55a6837af546544118e4aafa5d5a541?nocache=1" target="_self">Link</A>&nbsp;</P> <P>&nbsp;</P> <P>Please check my file and remove the false positives</P> <P>&nbsp;</P> <P>Password archive:</P> <P>infected</P> Mon, 20 May 2024 07:56:58 GMT NemoiKiller 2024-05-20T07:56:58Z False Positive https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587246#M2451 <P>File Hash:<A class="text-truncate" style="text-decoration: none; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: #20242c; font-family: 'Source Sans Pro', Roboto, RobotoDraft, Helvetica, Arial, sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;" target="_blank">ca38a0493182414a3a1a5233fd4e07435247934e46cfae433defcd4a5fda8a3c</A></P> <P>&nbsp;</P> <P>Link to Virustotal report for the file:</P> <P><A href="https://www.virustotal.com/gui/file/ca38a0493182414a3a1a5233fd4e07435247934e46cfae433defcd4a5fda8a3c/details" target="_self">Link</A></P> <P>&nbsp;</P> <P>Current VirustTotal Verdict:</P> <P>Generic.ml</P> <P>&nbsp;</P> <P>Description:<BR />Good afternoon!</P> <P>&nbsp;</P> <P><SPAN>This .exe file connects to and uses only the wproxy.me domain (api.wproxy.me and files.wproxy.me)</SPAN></P> <P>&nbsp;</P> <P><SPAN>These URLs are clean:</SPAN></P> <P data-unlink="true">VirusTotal ( https://api.wproxy.me )</P> <P><A href="https://www.virustotal.com/gui/url/21fb86407f735d350c704d4f805bce52ba2fb78e40053174c6b5dbb47e932a3a?nocache=1" target="_self">Link</A>&nbsp;</P> <P data-unlink="true">VirusTotal ( https://files.wproxy.me )</P> <P><A href="https://www.virustotal.com/gui/url/5c6ac85c32d712b29a2cf2aafb7e8ddae55a6837af546544118e4aafa5d5a541?nocache=1" target="_self">Link</A>&nbsp;</P> <P>&nbsp;</P> <P>Please check my file and remove the false positives</P> <P>&nbsp;</P> <P>Password archive:</P> <P>infected</P> Mon, 20 May 2024 07:56:58 GMT https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587246#M2451 NemoiKiller 2024-05-20T07:56:58Z Re: False Positive https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587322#M2452 <P>This file has been submitted for review.</P> Mon, 20 May 2024 20:54:57 GMT https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587322#M2452 DaBone 2024-05-20T20:54:57Z Re: False Positive https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587593#M2460 <P style="border: 0px solid; --tw-border-spacing-x: 0; --tw-border-spacing-y: 0; --tw-translate-x: 0; --tw-translate-y: 0; --tw-rotate: 0; --tw-skew-x: 0; --tw-skew-y: 0; --tw-scale-x: 1; --tw-scale-y: 1; --tw-scroll-snap-strictness: proximity; --tw-ring-offset-width: 0px; --tw-ring-offset-color: #fff; --tw-ring-color: rgba(0,125,178,.5); --tw-ring-offset-shadow: 0 0 #0000; --tw-ring-shadow: 0 0 #0000; --tw-shadow: 0 0 #0000; --tw-shadow-colored: 0 0 #0000; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; box-sizing: border-box; margin: 0px; color: #333333; line-height: inherit; font-size: 22px; font-style: normal; font-variant-ligatures: none; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: pre-wrap; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><FONT size="3"><SPAN class="--l sentence_highlight">Good afternoon!</SPAN><SPAN class="--r sentence_highlight"><BR style="border: 0px solid; --tw-border-spacing-x: 0; --tw-border-spacing-y: 0; --tw-translate-x: 0; --tw-translate-y: 0; --tw-rotate: 0; --tw-skew-x: 0; --tw-skew-y: 0; --tw-scale-x: 1; --tw-scale-y: 1; --tw-scroll-snap-strictness: proximity; --tw-ring-offset-width: 0px; --tw-ring-offset-color: #fff; --tw-ring-color: rgba(0,125,178,.5); --tw-ring-offset-shadow: 0 0 #0000; --tw-ring-shadow: 0 0 #0000; --tw-shadow: 0 0 #0000; --tw-shadow-colored: 0 0 #0000; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif !important; box-sizing: border-box;" /></SPAN></FONT></P> <P style="border: 0px solid; --tw-border-spacing-x: 0; --tw-border-spacing-y: 0; --tw-translate-x: 0; --tw-translate-y: 0; --tw-rotate: 0; --tw-skew-x: 0; --tw-skew-y: 0; --tw-scale-x: 1; --tw-scale-y: 1; --tw-scroll-snap-strictness: proximity; --tw-ring-offset-width: 0px; --tw-ring-offset-color: #fff; --tw-ring-color: rgba(0,125,178,.5); --tw-ring-offset-shadow: 0 0 #0000; --tw-ring-shadow: 0 0 #0000; --tw-shadow: 0 0 #0000; --tw-shadow-colored: 0 0 #0000; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; box-sizing: border-box; margin: 0px; color: #333333; line-height: inherit; font-size: 22px; font-style: normal; font-variant-ligatures: none; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: pre-wrap; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><FONT size="3"><SPAN class="--l --r sentence_highlight">How soon will the file be checked out?</SPAN></FONT></P> Wed, 22 May 2024 09:31:34 GMT https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587593#M2460 NemoiKiller 2024-05-22T09:31:34Z Re: False Positive https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587713#M2462 <P>Typically they are done by now.&nbsp; I have requested an update on this review.&nbsp;</P> Wed, 22 May 2024 22:52:27 GMT https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587713#M2462 DaBone 2024-05-22T22:52:27Z Re: False Positive https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587716#M2463 <P>File is no longer seen as malware by Palo Alto Networks.&nbsp;</P> Thu, 23 May 2024 00:42:15 GMT https://live.paloaltonetworks.com/t5/virustotal/false-positive/m-p/587716#M2463 DaBone 2024-05-23T00:42:15Z