Wildfire Virus detected on firewall but not on Wildfire Portal

FMueller — Sat, 03 Oct 2020 01:46:11 GMT

Hi,

the file t32.exe is considered as wildfire-virus Win32.WPCGeneric.cnp and blocked on the firewall.

But when checking this file on Virustotal and eu.wildfire.paloaltonetworks.com/wildfire/ it is considered as benign.

https://www.virustotal.com/gui/file/352df104254095ddf925514d99bfb5411c95b5386e90caf06557979f82e16844/detection

The file is part of the pip wheel https://pypi.org/project/pip/20.1/#files.

What could cause this behaviour? I have the latest wildfire updates installed on the firewall.

Re: Wildfire Virus detected on firewall but not on Wildfire Portal

BPry — Sat, 03 Oct 2020 03:54:56 GMT

@FMueller,

I'd recommend reaching out to TAC and creating a false-positive report. The generic signatures are exactly that, generic. When you submit a file to WildFire it actually goes through a full sandbox analysis and these generic signatures really aren't used.

topic Re: Wildfire Virus detected on firewall but not on Wildfire Portal in General Topics

Wildfire Virus detected on firewall but not on Wildfire Portal

Re: Wildfire Virus detected on firewall but not on Wildfire Portal