Wildfire Alert - Malicious status but benign detail

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Wildfire Alert - Malicious status but benign detail

L4 Transporter

Has anyone else seen this before?  A Wildfire verdict is coming back as 'malware\malicious', but the detail shows benign.

I am assuming that the 'missing' second VM maybe malicious in status, so it may be more a case of this analysis being missing in the UI.

wildfire.jpg

1 REPLY 1

L5 Sessionator

Hello apackard,

The top verdict of the WildFire report is the final result for the entire sample, while the individual verdicts that are marked as malicious/malware are on a per virtual machine (VM) basis. Each VM creates a verdict based on file types, such as, exe and pdf. The VM verdict is authoritative for the individual VM run, and the verdict on the sample is authoritative for the entire sample. Additional heuristics are applied to the sample verdict.

In the above case, the individual VM displayed some malicious behaviors but the applied algorithm deemed the sample was not malicious.

The sample verdict is the superior result.

Thanks and regards,

Kunal Adak

  • 2256 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!