file getting blocked (false positive)

[Salathiwe]

Can I get assistance on this false positive.

9a27f17d859d7f60a26030c7a0ef3698ffa0ff5ff4230963e52ab79a6a4dacdf

Virus/Win32.WGeneric.dyafjk

Unique Threat ID: 575312775
Create Time: 2023-03-15 02:43:51 (UTC)

[djr]

I have been seeing this since 17th March on downloads of utorrent installer which appear to be legitimate

URL: llsw.download3.utorrent.com/3.6.0/utorrent.46738.installer.exe

I have raised this with our support partner.

[Salathiwe]

Support Partner as in Palo Alto  (TAC) ?

[djr]

It has been raised with TAC via our support partner.  I am not getting sensible answers yet from either.

[djr · Accepted solution]

I have an answer from TAC that they are confident the file I have queried is malicious.  I still find that odd, but that's their assessment.

[ymiyashita]

If you suspect that the verdict is incorrect, you can submit a verdict change request.

Reference:
- WildFire report incorrect verdict (virus false positive or false negative)
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm7KCAS

[djr]

That is interesting.  I submitted the URL of the file to wildfire and that decided it was benign.  Do you know if that automatically reclassifies it, or is that just an assessment for information?

[ymiyashita]

The WildFire verdict of the sample (9a27f17d859d7f60a26030c7a0ef3698ffa0ff5ff4230963e52ab79a6a4dacdf) is still "Malware".
Please go into the report itself and check the verdict and the hash value.

If the hash value is different, you may want to submit the sample rather than the URL.

[djr]

Thank you for pointing that out.  I find it odd that on one screen it says Benign, but if you click for details it says it is malicious.  The hash does match so it seems they do believe it's bad so blocking it is the right thing to do. 

Thanks again

[ymiyashita]

Ok, thanks for checking the report.

By the way, please note that submitting the same sample or the URL of the same sample doesn't trigger the reclassification (especially, when it's uploaded to the same regional cloud), e.g. the WildFire just reuses the existing result.

If you submit a verdict change request, then the sample will be re-analyzed by the Palo Alto Networks researcher/engineer manually.