Wildfire Alert - Malicious status but benign detail

Reply
Highlighted
L4 Transporter

Wildfire Alert - Malicious status but benign detail

Has anyone else seen this before?  A Wildfire verdict is coming back as 'malware\malicious', but the detail shows benign.

I am assuming that the 'missing' second VM maybe malicious in status, so it may be more a case of this analysis being missing in the UI.

wildfire.jpg

Highlighted
L5 Sessionator

Re: Wildfire Alert - Malicious status but benign detail

Hello apackard,

The top verdict of the WildFire report is the final result for the entire sample, while the individual verdicts that are marked as malicious/malware are on a per virtual machine (VM) basis. Each VM creates a verdict based on file types, such as, exe and pdf. The VM verdict is authoritative for the individual VM run, and the verdict on the sample is authoritative for the entire sample. Additional heuristics are applied to the sample verdict.

In the above case, the individual VM displayed some malicious behaviors but the applied algorithm deemed the sample was not malicious.

The sample verdict is the superior result.

Thanks and regards,

Kunal Adak

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!