topic wildfire findings into the pan-db in General Topics

wildfire findings into the pan-db

sebastian — Thu, 19 Jun 2014 11:15:02 GMT

Hi there,

today a user tried to download a wallpaper from www.wallsave.com

Wildfire says it is Malware.

https://wildfire.paloaltonetworks.com/wildfire/reportdetail/2d6540e44f081882b611e1ed702e8f0032d309f0311ae0232f9a9a8da082e306/422433975/2

A few engines from virustotal also:

https://www.virustotal.com/de/url/59e5f7d67a03d71946dd6b617c1ff130aec6b6b4178519ad9d77cc076b5c7a17/analysis/1403173699/

(www.wallsave.com/get/2588352)

So my question is: why or when is this site marked as malware in the pan-db cloud?

actual:

>test url-info-cloud http://www.wallsave.com/

BM:

wallsave.com,9,3,shareware-and-freeware

Thanks, Sebastian

Re: wildfire findings into the pan-db

tiwara — Thu, 19 Jun 2014 11:33:59 GMT

I think the URL reputation is malware and malicious site . which version of wildfire you are using .

Re: wildfire findings into the pan-db

sebastian — Fri, 20 Jun 2014 05:42:12 GMT

Now it's getting funny.
Can please someone explain that to me?

That's my response to my change request for that malware site.

---
SUBJECT: Change request processed for: www.wallsave.com

Thank you once again for your submission. After careful evaluation, we have determined that the original categorization is correct, and as such, its category will not change.

URL: www.wallsave.com
Current category: shareware-and-freeware
You suggested: malware
If you'd like to submit another request, please visit:
http://urlfiltering.paloaltonetworks.com/testASite.aspx

Thanks,
Palo Alto Networks

Re: wildfire findings into the pan-db

dyang — Fri, 20 Jun 2014 06:49:05 GMT

Hi Sebastian,

Generally speaking, if WildFire has identified a downloaded file as malicious, the corresponding domain should also be categorized by PAN-DB as malware. There are a few exceptions to this, so I'm looking into the reason for your case. I'll report back as soon as I get more information.

--Doris