What purpose is 'download sample file' button in wildfire analysis report tab with FW 6.0.0 and WF-500 6.0.0?

[KiCheon.Lee]

Hello

I am testing wildfire with FW 6.0.0 and WF-500 6.0.0

I don't know what purpose 'download sample file' button and how to use.

Could someone please let me know it?

[kdd]

Hi cheon,

this sample was determined to benign. If you believe this verdict is incorrect, you can send a sample to PA for more analysis.

This could be done by "download file" then you can upload this sample to wildfire.paloaltonetworks.com

Cheers Klaus

[HITSSEC]

Cheon,

The button and the function associated with it is to allow you to pull a copy of the file so that you can test if if you wish in a local environment..  You can also run your own antivirus or anti-malware tools against it.  We sometimes run the software sample in a virtual environment of our own to better understand what the software does.  This is quite useful for the spyware or adware like programs that may trigger a malicious rating. Often shareware or some utility software may trigger alerts as being malware any you may wish to run the software yourself in a safe and isolated environment.  In our case we are not in the same location of the majority of our users so if we can emulate the event then we can better asses those borderline pieces of software and pass judgement on them.  Hope this sheds some light,

Phil

[kdd]

Hi HITSSEC,

you are right. It is not to PA it is from PA to have the possibilties you mentioned. So my fault, sorry.

Cheers Klaus

[KiCheon.Lee]

Thanks for the answer.

I think the sample file does not equal the real PE , Office and PDF file.

So can WF-500 make from real file to sample file? How to sampling?

And I don't know how to use the sample file.

What software should i use for the sample file.

Please let me know way with example to use the sample file.

Cheon