Palo Alto Networks false positive 'Generic.ml' for b64.exe on VirusTotal

[bstewart]

virustotal.com reports a false positive detection of 'Generic.ml' for the 'Palo Alto Networks' engine for this file:

https://www.virustotal.com/gui/file/28b1072fa457a6291eb86935ffee0527a1446c55a6070fabd825ce918f64f0ab

File: b64.exe
SHA256 hash: 28b1072fa457a6291eb86935ffee0527a1446c55a6070fabd825ce918f64f0ab
Download link: https://github.com/Bill-Stewart/b64/releases/download/v0.0.1/b64-0.0.1.zip

This file is not malware; it is an open-source Windows command line utility for converting data to and from base64 format.

File is attached; zip file password: notvirus

Rename to b64.exe to validate.

Please remediate this false positive detection and advise when completed.

[DaBone]

File isn't signed...

[bstewart]

An unsigned file does not mean said file is malware.

In fact, it can actually be a disadvantage to digitally sign open source executables because signing changes the binary file, which means that someone who tries to compile said executable ends up with a different binary -- and one of the purposes of having open-source software is the ability to produce the same binary file.

[bstewart]

FWIW - I would also point out that the download zip file (b64-0.0.1.zip) has both i386 and x86_64 (aka AMD64) executables. Both executables are compiled from the same source code, but the 'Palo Alto Networks' engine only flags the i386 executable as 'Generic.ml' (the x86_64 build isn't flagged by the engine).

[DaBone]

File submitted for review

[bstewart]

Thank you

[DaBone · Accepted solution]

SHA256: 28b1072fa457a6291eb86935ffee0527a1446c55a6070fabd825ce918f64f0ab
After further review, the file was determined to be benign, and the signature for this file has been removed.

[bstewart]

Thanks for the assistance, much appreciated!