False Positive Submission (generic.ml)

[MichalSlezak]

Dear Palo Alto community, This file was flagged by PA as a possible threat (generic.ml)

File name: apisetstub

SHA 256: 960244839b0b9f45fa610ea16bde72165b67291bf2348cf22e02a11eefba787c

Current VT verdict: generic.ml URL: 

https://www.virustotal.com/#/file/960244839b0b9f45fa610ea16bde72165b67291bf2348cf22e02a11eefba787c/d...

I found out that:

• Detected file is dynamic library, part of the new kernel architecture Microsoft has introduced for Windows 7.
• Relevant source: https://www.processlibrary.com/en/directory/files/api-ms-win-core-processthreads-l1-1-0/668/
• Based on mentioned source, is unlikely that file to pose any harm to system

As this file was triggered multiple times in our environment and should be FP, could you please review this file from your end?

This may be false positive detection.

Thank you very much for your support.

[DaBone]

Please submit the following information in the order listed below so that our team can investigate your claim and change verdicts when warranted.

File Hash: <hash>

Link to Virustotal report for the file: <link>

Current VirustTotal Verdict: <verdict>

Description: <description>

[MichalSlezak]

File Hash: 960244839b0b9f45fa610ea16bde72165b67291bf2348cf22e02a11eefba787c

Link to Virustotal report for the file: https://www.virustotal.com/#/file/960244839b0b9f45fa610ea16bde72165b67291bf2348cf22e02a11eefba787c/d...

Current VirustTotal Verdict: generic.ml

Description: 

I found out that:

• Detected file is dynamic library, part of the new kernel architecture Microsoft has introduced for Windows 7.
• Relevant source: https://www.processlibrary.com/en/directory/files/api-ms-win-core-processthreads-l1-1-0/668/
• Based on mentioned source, is unlikely that file to pose any harm to system

As this file was triggered multiple times in our environment and should be FP, could you please review this file from your end?

This may be false positive detection.

Thank you very much for your support.

[tdavault]

Hello, 

Your file has been added for review. 

[tdavault · Accepted solution]

The verdict for this file has been changed to benign.