About hisingh

hisingh

Hello, I heard back from the malware team, they have marked this as grayware. Best,

hisingh

Hello, I heard back from the malware team, they have marked this as grayware. Best,

hisingh

Hello, I have requested for a recheck on this hash, I will update you once I hear more. Best Himani

hisingh

Hello, I have submitted your hash for the review, I will update you once I hear more Thanks

hisingh

Hello, The verdict of this hash and file is marked as benign. Thanks

hisingh

Hello, The verdict of this hash and file is marked as benign. Thanks

hisingh

Hello, The verdict of this hash and file is marked as benign. Thanks

hisingh

Hello. We are going to recheck this one Best

hisingh

Hello Have submitted for a recheck Best

hisingh

Hello We have submitted for re-check Best

hisingh

Hello The verdict of this file has been changed to benign. Best

hisingh

Hello, The file is rechecked based on the information provided by you, we have marked this file as clean. I hope this helps. Best

hisingh

Hello. We are rechecking this file on your request and I will update you. Thanks

hisingh

Hello, We are rechecking this hash and I will update you when I learn more about this hash. Best

hisingh

Hello, Can you zip this file "EZhelp20.exe " with password "infected" and host somewhere we can download? Also, include the previous file that was not considered as malicious. kind regards

hisingh

Hello, Thank you for the new info, l will check again and update. Best Himani

hisingh

Hello, I heard back from our malware team. They have removed the verdict as malware, however, decided to mark as " grayware sample" Best Himani

hisingh

Hello, I heard back from our malware team, we have decided to keep this as malware based on their analysis. Best Regards, Himani

hisingh

Hello, I heard back from the backend team, the verdict is changed to benign. It will take about 24-48 hours till the AV database updates. Best Himani

hisingh

Hello I have requested for a recheck, I will update you as soon as I hear more. Best

hisingh

Hello, I have submitted the hash. This sha256check is different than the file (wLTSx6ZWW93mSKC) you posted earlier using the link I will update you once I hear more Thanks

hisingh

Hello, I have submitted the re-check request based on the hash. We could not download the file because the file was not zipped by a password, and will be blocked by the firewalls. Best Himani

hisingh

Hello. Please check now. On Virustotal. I do not see Paloalto Networks identify this file as malicious. In fact, this seems to be undetected. https://www.virustotal.com/gui/file-analysis/NzI4NzU2YmRmOTg4OTk1ODhkZDAwMjhlMDViMGE2MWI6MTU4MzE3NDU5MA==/detection Please let me know if you see otherwise. Best Himani

hisingh

Hello. I have checked the file wLTSx6ZWW93mSKC in my lab, and no signature was generated. Can you please add the name of threat or threat ID Best Himani

hisingh · ‎02-20-2020

Hello The verdict has been changed on this hash and file. Best Himani

hisingh · ‎02-19-2020

Hello, DNS proxy will not conflict with our web proxies. A Palo Alto Networks firewall intermediate to clients and servers can act as a DNS proxy to resolve domain name queries. Basically, the firewall can resolve corporate domains based on a corporate DNS server hostname-to-IP-address mappings, and resolve other domains using a public or ISP DNS server. That way the if the final domain's IP is been different due to load-balanced, Firewall has the correct information and it will not trigger the "Suspicious TLS Evasion Suggestion" Best Himani

hisingh · ‎02-19-2020

Hello I have submitted this hash for re-analysis. I will update you once I hear more from our team. Best Himani

hisingh · ‎02-06-2020

Yes, it is a hacking website. you can check it here: https://urlfiltering.paloaltonetworks.com/query/

hisingh · ‎02-06-2020

Hello Fidele, I understand that you want to access 'shodan.io' and it was blocked as a hacking site. There are a couple of ways. (a) you can override your URL filtering object and allow hacking sites. (b) Depending on the PAN-OS, you can add one site in exception as a white list (c) you can create a custom URL object and allow it. (d) If you only want to allow for one user, you can create a policy based on the user, and URL some useful documents. https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/url-filtering/url-filtering-concepts/url-category-exception-lists.html https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/url-filtering-concepts/block-and-allow-lists https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CltmCAC Thanks Himani

hisingh · ‎02-05-2020

Hello Hattracker, 1. Please check your zone protection setting, what is the threshold is set for it? 2. Have you applied for the zone protection on the internal/ trust interface? 3, Please scan one of the clients with host-based IPS and AV, see if any ports are open. Thanks Himani

Date Registered	‎07-11-2018 04:42 AM
Date Last Visited	6 hours ago
Total Messages Posted	97
Total Likes Received	27

Online Status	Offline
Date Last Visited	6 hours ago

Enterprise

Prisma

Cortex

About hisingh