topic Re: False positive report in VirusTotal

False positive report

Alkazuz — Sat, 23 Mar 2019 14:45:04 GMT

File Hash: 77f6699f29fada671828d75749c36ee5c98918a1dacab989be6613663702259f

Link to Virustotal report for the file: https://www.virustotal.com/#/file/77f6699f29fada671828d75749c36ee5c98918a1dacab989be6613663702259f/detectionhttps://virustotal.com/en/file/b44bbdfec96398f4f635fce7692b5732421d073ab3ce094912b708ce3e925ceb/**bleep**...

Current VirustTotal Verdict: generic.ml

Download file: http://AdvancedBot.tk/AdvancedBot.exe

Description: false positive of file "AdvancedBot.exe" for "Palo Alto Networks (Known Signatures)"

The file is clean for everything else on virustotal.

I am an author of the software.

Re: False positive report

tdavault — Fri, 29 Mar 2019 18:30:34 GMT

Can you please verify the file hash?

Although the hyperlink "appears" to match the digest it in fact is referencing a different hash.

The actual VT link for the hash (77f6699f29fada671828d75749c36ee5c98918a1dacab989be6613663702259f) is showing as very malicous.

Re: False positive report

dparris — Fri, 12 Apr 2019 13:34:52 GMT

I have sumitted the hash 77f6699f29fada671828d75749c36ee5c98918a1dacab989be6613663702259f for manual review even though it has 10 other hits on Virus total.

Manual review will determine Palo Alto's stance on this file.

Re: False positive report

dparris — Tue, 16 Apr 2019 19:49:29 GMT

We are unable to whitelist this file at this time. hash 77f6699f29fada671828d75749c36ee5c98918a1dacab989be6613663702259f