topic Re: Palo Alto Networks generic.ml: JRS_SLE.EXE in VirusTotal

Palo Alto Networks generic.ml: JRS_SLE.EXE

jrs-soft — Wed, 06 Mar 2019 20:50:32 GMT

I'm reporting a false positive for the file: JRS_SLE.EXE. On Virustotal.com Palo Alto Networks flags the file as "generic:ml" when, in fact, the program is harmless. It's actually part of our anti-piracy protection. I wrote and compiled the program. Furthermore, the file is signed by Jurik Research Software, Inc. with a digital certificate. If Palo Alto Networks need a copy of the file or further information, let me know.

Re: Palo Alto Networks generic.ml: JRS_SLE.EXE

tdavault — Wed, 06 Mar 2019 21:52:13 GMT

Hello,

Please provide the following information so that we may assist you further:

File Hash: <hash>

Link to Virustotal report for the file: <link>

Current VirustTotal Verdict: <verdict>

Re: Palo Alto Networks generic.ml: JRS_SLE.EXE

jrs-soft — Wed, 06 Mar 2019 22:11:31 GMT

Thanks for the repy.

SHA-256 19d4d041a07c50fdf3a828f2676869d99ac14fb13f43ca8d3c66fc9a6daabe91

https://www.virustotal.com/#/file/19d4d041a07c50fdf3a828f2676869d99ac14fb13f43ca8d3c66fc9a6daabe91/detection

I'm not sure what you mean by verdict, but 8 of 69 malware engines falsely detect the file as being malware.

Re: Palo Alto Networks generic.ml: JRS_SLE.EXE

mivaldi — Thu, 07 Mar 2019 21:36:00 GMT

I don't see any generic:ml for that sample for Palo Alto Networks. We have made no changes.

Do you have the right sha256?

Re: Palo Alto Networks generic.ml: JRS_SLE.EXE

jrs-soft — Fri, 08 Mar 2019 04:10:19 GMT

The hash is correct, but some explanation is in order. Yesterday, I noticed that the file listed on VirusTotal was a little out of date, so I uploaded the current version (which will soon be updated again) and the detection results changed. Now, 6 out of 64 engines detect it as malware, and Palo Alto Networks is not listed as detecting it or showing it as clean.

Perhaps you have some idea why it's not appearing in either group now.