Palo Alto Networks generic.ml: JRS_SLE.EXE

[jrs-soft]

I'm reporting a false positive for the file: JRS_SLE.EXE. On Virustotal.com Palo Alto Networks flags the file as "generic:ml" when, in fact, the program is harmless. It's actually part of our anti-piracy protection. I wrote and compiled the program. Furthermore, the file is signed by Jurik Research Software, Inc. with a digital certificate. If Palo Alto Networks need a copy of the file or further information, let me know.

[tdavault]

Hello, 

Please provide the following information so that we may assist you further:

File Hash: <hash>

Link to Virustotal report for the file: <link>

Current VirustTotal Verdict: <verdict>

[jrs-soft]

Thanks for the repy.

SHA-256 19d4d041a07c50fdf3a828f2676869d99ac14fb13f43ca8d3c66fc9a6daabe91

https://www.virustotal.com/#/file/19d4d041a07c50fdf3a828f2676869d99ac14fb13f43ca8d3c66fc9a6daabe91/d...

I'm not sure what you mean by verdict, but 8 of 69 malware engines falsely detect the file as being malware.

[mivaldi]

I don't see any generic:ml for that sample for Palo Alto Networks. We have made no changes.

Do you have the right sha256?

[jrs-soft · Accepted solution]

The hash is correct, but some explanation is in order. Yesterday, I noticed that the file listed on VirusTotal was a little out of date, so I uploaded the current version (which will soon be updated again) and the detection results changed. Now, 6 out of 64 engines detect it as malware, and Palo Alto Networks is not listed as detecting it or showing it as clean.

Perhaps you have some idea why it's not appearing in either group now.