topic Re: MTGAInstaller.exe False Positive (generic.ml) in VirusTotal

MTGAInstaller.exe False Positive (generic.ml)

onedrum — Mon, 09 Apr 2018 17:53:02 GMT

We have users asking about this file being blocked, so I'm looking into it for them. This looked like it was flagged as a false positive back in January in a similar way:

https://live.paloaltonetworks.com/t5/VirusTotal/MTGAInstaller-exe/m-p/196540#M334

So I wanted to do my due diligence and try to verify that this isn't another false positive. Can someone take a look, perhaps?

File Hash: 28a290fd512631abf5132a099d9153498a26bda2f9e92d72f63e69d3725b793d

Link to Virustotal report for the file: https://www.virustotal.com/en/file/28a290fd512631abf5132a099d9153498a26bda2f9e92d72f63e69d3725b793d/analysis/

Current VirustTotal Verdict: malware (generic.ml)

Description: Detection ratio 4/66

Thanks!

Re: MTGAInstaller.exe False Positive (generic.ml)

mivaldi — Mon, 09 Apr 2018 19:57:07 GMT

Thank you. I found there was a request already submitted by a Palo Alto Networks customer on this sample.

The sample will be analyzed for verdict reconsideration shortly.

Re: MTGAInstaller.exe False Positive (generic.ml)

onedrum — Fri, 13 Apr 2018 16:32:40 GMT

Hi mivaldi,

Has this been analyzed yet? I assumed it may take a few days, but we're at four days so I'm thinking perhaps my expectations are off.

Thanks!

Re: MTGAInstaller.exe False Positive (generic.ml)

mivaldi — Fri, 13 Apr 2018 17:23:33 GMT

Yes it has and it has been found to be Benign.

Sorry I didn't circle back to you earlier, I was not notified when the change was made because I was not who placed the original request.