False Positive Submission (generic.ml)

[andrei.ihnatsenka]

Hello!

We have checked our software on VirusTotal and see false positive detection (generic.ml). "Palo Alto Networks" is the only antivirus software which detects malicious behavior in our application. Please fix the issue.
The file is available here.

File Hash: SHA-256 49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2

Link to Virustotal report for the file: https://www.virustotal.com/#/file/49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2/d...

Current VirustTotal Verdict: One engine detected this file

Actual file: link

Thank you!

[andrei.ihnatsenka]

Guys, do you have updates on this?

[mivaldi]

Submitted 49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2 for FP analysis.

If it is confirmed to be Benign, the signature will get disabled within the next 3 business days.

[mivaldi]

Sample 49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2 has been found to be Benign.

The signature will be disabled with tomorrow's Antivirus release.

[andrei.ihnatsenka]

Thank you very much!

I'm curious will the avtivirus sofware detect a new version of the same software as malicious? The new version will have new version numbers, hashes, newer signing date, etc. Do we need to submit every version of the application to be added to "white" list?

[mivaldi]

I'll submit a separate request to evaluate adding the signer of 49c5b93e1d5fe16113563dd9f537714d0a7d8e631aebfa5e31199473d79ccff2 to Palo Alto Networks' trusted signer list.

I'll let you know once I hear back from our Threat Researchers.

[mivaldi · Accepted solution]

"BuildingLink.com, LLC" has been added to the trusted signer list.

[andrei.ihnatsenka]

Thank you very much for all your help!