topic Re: False Positive Submission (generic.ml) in VirusTotal

False Positive Submission (generic.ml)

kns123 — Wed, 04 Apr 2018 08:21:10 GMT

Kindly check IE New Tab Installer from SpringTech

VirusTotal links:

https://www.virustotal.com/#/file/a02a23cb14cbec75700a9c4af1c497a25ddb9b52fd0e0cfe5f91e0be7f30a232/detection

https://www.virustotal.com/#/file/604ee5d72f162ba2ab80a2b236dfdf601d0ef6b0a3ffd733bc47255992993535/detection

Current VT Verdict: generic.ml

Thank you.

Re: False Positive Submission (generic.ml)

tsullivan7 — Wed, 04 Apr 2018 17:43:48 GMT

This will be processed for a manual review if it does appear to be a false positive a verdict change will be made.

Re: False Positive Submission (generic.ml)

tsullivan7 — Wed, 04 Apr 2018 17:53:44 GMT

This file was processed for a manual evaluation:

https://www.virustotal.com/#/file/604ee5d72f162ba2ab80a2b236dfdf601d0ef6b0a3ffd733bc47255992993535/detection

but this one was not, as we don't have it labled as malicious:

https://www.virustotal.com/#/file/a02a23cb14cbec75700a9c4af1c497a25ddb9b52fd0e0cfe5f91e0be7f30a232/detection

Re: False Positive Submission (generic.ml)

tsullivan7 — Fri, 06 Apr 2018 10:47:02 GMT

This sample was manually evaluated and determined to be Greyware and the verdict has been changed. It no longer shows as malware on Virus Total. If you wonder what our classification for Greyware is see the below link and description.

https://www.paloaltonetworks.com/documentation/translated/70/newfeaturesguide/wildfire-features/wildfire-grayware-verdict

The WildFire grayware verdict classifies files that behave similarly to malware, but are not malicious in nature or intent. A grayware verdict might be assigned to files that do not pose a direct security threat, but display otherwise obtrusive behavior (for example, installing unwanted software, changing various system settings, or reducing system performance). Examples of grayware software can typically include adware, spyware, and Browser Helper Objects (BHOs). The grayware verdict allows you to quickly distinguish malicious files on the network from grayware, and to prioritize accordingly.

Antivirus signatures are not generated for grayware and security policies cannot be enforced based on the grayware verdict. However, logs and reports can continue to alert to endpoints downloading grayware, enabling you to take any necessary action.

Re: False Positive Submission (generic.ml)

kns123 — Fri, 06 Apr 2018 23:16:18 GMT

Noted on this, thank you!