topic Re: False-positive submission in VirusTotal

False-positive submission

roipaz — Sun, 30 Sep 2018 13:56:37 GMT

Hi, Please find false-positive detection. VirusTotal link: https://www.virustotal.com/#/file/f40e85443f50cb78db68c343bc53d7fc30d05f6f4ac58ad59d492e7088478be5/detection SHA-256 f40e85443f50cb78db68c343bc53d7fc30d05f6f4ac58ad59d492e7088478be5 The file can be downloaded from: https://cdn4.hola.org/static/Hola-Setup-x64-1.108.133.exe Would appreciate your clearance of the false-positive detection ASAP and please verify that Hola Networks digital signature was added to trusted signer list, please see paloalto live community recent discussions. Thanks, Roi

Re: False-positive submission

hisingh — Mon, 01 Oct 2018 21:00:50 GMT

Hello Roipaz,

We are looking at the possibility of the False positive on this case, I will update you when we are finished with our research.

Thanks

Himani

Re: False-positive submission

hisingh — Tue, 02 Oct 2018 18:42:26 GMT

The verdict for "f40e85443f50cb78db68c343bc53d7fc30d05f6f4ac58ad59d492e7088478be5" is no longer listed as malicious. VirusTotal is been updated, the AntiVirus next release will have updated information.

Thanks

Himani

Re: False-positive submission

roipaz — Tue, 02 Oct 2018 18:04:32 GMT

Thank you Haimani, When it will be a convenient time for you to have a short call to discuss how to prevent the repeating false-positive? Thanks, Roi

Re: False-positive submission

dparris — Tue, 02 Oct 2018 18:48:59 GMT

Hello Roipaz,

We are not able to call or support non customers.

I have checked with engineering and they declined to add your files to the trusted signer white list.

If you disagree with a verdict for a file, you will have to ask for evaluation on a file by file basis.

Thank you

Don, Palo Alto Threat Specialist

Re: False-positive submission

roipaz — Tue, 02 Oct 2018 19:17:36 GMT

Hi Don, What cause the false-positive detection? Is there something we can do from our side to prevent such cases to happened so frequently? Thanks, Roi

Re: False-positive submission

dparris — Tue, 02 Oct 2018 20:37:25 GMT

In many of the cases it is the way you write your code. In this file for instance, you have the file copies itself ,contacts unregistered dns server , Uses http direct ip connection, uses http with no ua ,uses http requests with short headers. Along with many other pieces that are common in malware.