topic Re: Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal in VirusTotal

Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal

bstewart — Thu, 17 Sep 2026 18:32:05 GMT

virustotal.com reports a false positive detection of 'Generic.ml' for the 'Palo Alto Networks' engine for this file:

https://www.virustotal.com/gui/file/28b1072fa457a6291eb86935ffee0527a1446c55a6070fabd825ce918f64f0ab

File: b64.exe
SHA256 hash: 28b1072fa457a6291eb86935ffee0527a1446c55a6070fabd825ce918f64f0ab
Download link: https://github.com/Bill-Stewart/b64/releases/download/v0.0.1/b64-0.0.1.zip

This file is not malware; it is an open-source Windows command line utility for converting data to and from base64 format.

File is attached; zip file password: notvirus

Rename to b64.exe to validate.

Please remediate this false positive detection and advise when completed.

Re: Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal

DaBone — Fri, 18 Sep 2026 17:58:28 GMT

File isn't signed...

Re: Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal

bstewart — Fri, 18 Sep 2026 19:21:38 GMT

An unsigned file does not mean said file is malware.

In fact, it can actually be a disadvantage to digitally sign open source executables because signing changes the binary file, which means that someone who tries to compile said executable ends up with a different binary -- and one of the purposes of having open-source software is the ability to produce the same binary file.

Re: Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal

bstewart — Mon, 21 Sep 2026 14:11:28 GMT

FWIW - I would also point out that the download zip file (b64-0.0.1.zip) has both i386 and x86_64 (aka AMD64) executables. Both executables are compiled from the same source code, but the 'Palo Alto Networks' engine only flags the i386 executable as 'Generic.ml' (the x86_64 build isn't flagged by the engine).

Re: Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal

DaBone — Mon, 21 Sep 2026 17:10:01 GMT

File submitted for review

Re: Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal

bstewart — Mon, 21 Sep 2026 21:03:45 GMT

Thank you

Re: Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal

DaBone — Tue, 22 Sep 2026 16:40:03 GMT

SHA256: 28b1072fa457a6291eb86935ffee0527a1446c55a6070fabd825ce918f64f0ab
After further review, the file was determined to be benign, and the signature for this file has been removed.

Re: Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal

bstewart — Fri, 25 Sep 2026 14:26:54 GMT

Thanks for the assistance, much appreciated!