topic False Positive Submission (generic.ml) in VirusTotal

False Positive Submission (generic.ml)

MichalSlezak — Mon, 11 Mar 2019 06:24:48 GMT

Dear Palo Alto community, This file was flagged by PA as a possible threat (generic.ml)

File name: apisetstub

SHA 256: 960244839b0b9f45fa610ea16bde72165b67291bf2348cf22e02a11eefba787c

Current VT verdict: generic.ml URL:

I found out that:

Detected file is dynamic library, part of the new kernel architecture Microsoft has introduced for Windows 7.
Relevant source: https://www.processlibrary.com/en/directory/files/api-ms-win-core-processthreads-l1-1-0/668/
Based on mentioned source, is unlikely that file to pose any harm to system

As this file was triggered multiple times in our environment and should be FP, could you please review this file from your end?

This may be false positive detection.

Thank you very much for your support.

DaBone — Thu, 14 Mar 2019 15:12:16 GMT

Please submit the following information in the order listed below so that our team can investigate your claim and change verdicts when warranted.

File Hash: <hash>

Link to Virustotal report for the file: <link>

Current VirustTotal Verdict: <verdict>

Description: <description>

MichalSlezak — Fri, 15 Mar 2019 07:21:35 GMT

File Hash: 960244839b0b9f45fa610ea16bde72165b67291bf2348cf22e02a11eefba787c

Current VirustTotal Verdict: generic.ml

Description:

I found out that:

Detected file is dynamic library, part of the new kernel architecture Microsoft has introduced for Windows 7.
Relevant source: https://www.processlibrary.com/en/directory/files/api-ms-win-core-processthreads-l1-1-0/668/
Based on mentioned source, is unlikely that file to pose any harm to system

As this file was triggered multiple times in our environment and should be FP, could you please review this file from your end?

This may be false positive detection.

Thank you very much for your support.

tdavault — Fri, 15 Mar 2019 21:14:40 GMT

Hello,

Your file has been added for review.

tdavault — Fri, 15 Mar 2019 21:16:16 GMT

The verdict for this file has been changed to benign.