topic Re: FP Report on BA003.exe (md5 5fcec23f3a287e118af4a73966dc796d) in VirusTotal

FP Report on BA003.exe (md5 5fcec23f3a287e118af4a73966dc796d)

LS_Andy — Thu, 14 Jun 2018 13:45:44 GMT

Hi PaloAlto, One of our files, BA003.exe (md5 5fcec23f3a287e118af4a73966dc796d) is being flagged as generic.ml. Can I ask you to review and reassess the detected file in the context of the installer that uses the file, rather than as a stand-alone file, with the aim of removing BA003.exe from detection? Detected file and installer can be downloaded from hxxps://www.dropbox.com/s/u0mvnk5chxhojvw/20180614-BA003-PaloAltoDetections.7z?dl=0. Archive password: infected Thanks, Andrew Browne Director, Malware Labs Adaware

Re: FP Report on BA003.exe (md5 5fcec23f3a287e118af4a73966dc796d)

dparris — Thu, 14 Jun 2018 19:01:43 GMT

Hello LS_Andy,

Can you please post the SHA256 of the files you wish to have evaluated, I can not download files from dropbox.

Re: FP Report on BA003.exe (md5 5fcec23f3a287e118af4a73966dc796d)

LS_Andy — Fri, 15 Jun 2018 09:46:31 GMT

Hi dparris,

Thanks for getting back to me.

BA003.exe (detected file)

4b1210cdedc7601e1f2e4ddc12e42ea3e57bf389049f088b0fb7553bdb835ea5

trueburner_4.9.exe (installer that calls the detected file)
ac9bc0eeba287806898e1029d0a221ca5b702fd4c1eb08d82966ddfa6dc6a91a

Re: FP Report on BA003.exe (md5 5fcec23f3a287e118af4a73966dc796d)

dparris — Fri, 15 Jun 2018 20:17:21 GMT

I have added your hashes for reassessment.

Re: FP Report on BA003.exe (md5 5fcec23f3a287e118af4a73966dc796d)

tsullivan7 — Tue, 26 Jun 2018 19:20:17 GMT

The verdict for these samples is now benign so there should be no further issues with them.