Wildfire Alert - Malicious status but benign detail

[apackard]

Has anyone else seen this before?  A Wildfire verdict is coming back as 'malware\malicious', but the detail shows benign.

I am assuming that the 'missing' second VM maybe malicious in status, so it may be more a case of this analysis being missing in the UI.

[kadak]

Hello apackard,

The top verdict of the WildFire report is the final result for the entire sample, while the individual verdicts that are marked as malicious/malware are on a per virtual machine (VM) basis. Each VM creates a verdict based on file types, such as, exe and pdf. The VM verdict is authoritative for the individual VM run, and the verdict on the sample is authoritative for the entire sample. Additional heuristics are applied to the sample verdict.

In the above case, the individual VM displayed some malicious behaviors but the applied algorithm deemed the sample was not malicious.

The sample verdict is the superior result.

Thanks and regards,

Kunal Adak