How can I submit a false positive malicious file review by e-mail?

[netservicesgroup]

How can I submit a false positive malicious file review by e-mail?  I'm not a Palo Alto customer and have no access to the portal or software to follow the instructions I've found online.

Any help is appreciated.   Thank you.

[mivaldi]

Why do you want to report it via email?

[netservicesgroup]

I just want to submit a false positive for your review. I am not a Palo Alto customer and have no access to report it through the web portal.

   File - CheckRMM.exe
   md5: acf3e370e68a9970dced575a53b9b76e
   VirusTotal evaluation: https://www.virustotal.com/gui/file/9df6d9d6c362b28a3548e8fa4e89b159481503ca4a987f44471ffa5f12064650
   Download link to a compressed copy of this executable with a password of ‘infected’: https://www.netservicesgroup.com/sample/checkrmm.zip

Any assistance it appreciated. Thank you.

[DaBone]

You can follow this pinned post here:
https://live.paloaltonetworks.com/t5/virustotal/virustotal-verdict-change-request-for-false-positive... 

Please provide the information in the pinned post and we can take a look at the file.  

I noticed on VT that this has a VT score of 29/67.  Can you give some incite as to why there would be such a high score for this file?  What is a description of this file?

[netservicesgroup]

All this file does is check for the existance of a Windows service.  If the service doesn't exist it sends and e-mail to so our team can take corrective action.  Its written in PowerShell and compiled to a EXE using signtool.exe by Authenticode.

Here is the PowerShell script source with a variables redacted for out security purposes.

& {$H = HOSTNAME; $service = Get-Service -Name '<redacted for security reasons>' -ErrorAction SilentlyContinue;if($service -eq $null) {$HostIP = (Get-NetIPConfiguration | Where-Object {$_.IPv4DefaultGateway -ne $null -and $_.NetAdapter.Status -ne 'Disconnected'}).IPv4Address.IPAddress; $Subject = [System.String]::Concat($H, ' (' , $HostIP, ') does not have RMM installed');$PSEmailServer = '<redacted for security reasons>';$password = ConvertTo-SecureString '<redacted for security reasons>' -AsPlainText -Force;$Cred = New-Object System.Management.Automation.PSCredential ('<redacted for security reasons>', $password);Send-MailMessage -From '<redacted for security reasons>' -To '<redacted for security reasons>' -Subject $Subject -UseSsl -Port 587 -Credential $Cred;}};

Any assistance it appreciated. Thank you.

[DaBone]

I've submitted this for review

[DaBone]

This file is no longer seen as malware