WildFire Report With Verdict Malware Passed

[Mohammad.Qawasmeh]

Hello,

WildFire analysed a file considered as Malware

But the Dynamic analysis in the same report shows that it's Benign, How this could happen ?! 

and Traps allowed this file and considered this as notification, is there any explanation

[marthasimons]

Fixed? 

[efrancis]

@Mohammad.Qawasmeh 

The answer to your question is not very simple. There are several moving parts inline that could affect, and display the behavior you see. It would be recommended to open a ticket with support, who can assist in analyzing the issue, and escalate if needed.

[marthasimons]

Thanks

[BPry]

@Mohammad.Qawasmeh,

What likely happend is local analysis analyzed the file due to WildFire not having a verdict for the file hash, and that analysis didn't show any problems. When that file was later uploaded to WildFire the sandbox environment recognized malicious activity and labeled it as malware. Due to the file already being allowed to run, the only thing you'll get is a notification saying that it allowed this to run.

The good news is the hash is now known as malicious and it can't be run on any other device as long as they can check the hash verdict status with WildFire, so even though it allowed it on one machine it will block it going forward.