topic Re: False Positive Removal Request in VirusTotal

False Positive Removal Request

Artem.Razin — Fri, 26 Oct 2018 13:11:17 GMT

Hi,

Today I've got a request from one of my customers that Deleaker, a popular C++ profiler, is dected as malware by TRAPS from Palo Alto Networks.

File Hash: fe7e560f4cf440ffb7dd79fb8001c43c8760b3015aad0f677ddc99fde156e2f2

Here the virustotal report:

https://www.virustotal.com/#/file/fe7e560f4cf440ffb7dd79fb8001c43c8760b3015aad0f677ddc99fde156e2f2/detection

VirustTotal verdict: No engines detected this file

Description: DeleakerSetup_2018.37.0.0.exe is an installer of Deleaker.

The installer itself and all files being installed are code signed.

The installer can be downloaded here

Please fix it ASAP as customer can't install Deleaker.

Re: False Positive Removal Request

hisingh — Fri, 26 Oct 2018 19:01:58 GMT

HI Artem.Razin

This SHA256= fe7e560f4cf440ffb7dd79fb8001c43c8760b3015aad0f677ddc99fde156e2f2 is already benign.

This is a trap message, we think it was blocked by your traps client.

Please open a support case with traps team with threat log, threat-ID or signature is been triggered.

Thanks

Himani

Re: False Positive Removal Request

Artem.Razin — Sat, 27 Oct 2018 15:30:42 GMT

Himani,

Thank you for the fast reply.

I am sorry, probably I misunderstood you.

Do you mean this file is already whitelisted?

Thank you.

Re: False Positive Removal Request

hisingh — Sun, 28 Oct 2018 06:07:44 GMT

Hi Artem.Razin,

The file is blocked by traps; it could be a false positive case but with traps, not the wildfire. In the wildFire, this file is not identified as malware. By opening a case with traps, the team can be useful.

Thanks

Himani