Serious Discussion Behavior vs Signature: which is the best strategy?

[devjitdutta2025]

Ok

Blacklisted in ESET Cloud (Livegrid)
View attachment 295638

once again proved VT is not reliable.

 

[Parkinsond]

Ok

once again proved VT is not reliable.

Not exactly; when I was trying to check several samples using VT, ESET was ranked no.2 after K; cannot say with a single sample.

 

[ForgottenSeer 123960]

If you scan a file and it comes up clean on VirusTotal but your local AV blocks it, it's usually for one of these reasons.

AI/Machine Learning
Your local AV noticed the file's behavior (e.g., trying to modify system registry keys) was suspicious, which a static scan can't see.

Generic/Cloud Detections
The vendor might have flagged the file in their private cloud but hasn't yet packaged that into a static signature sent to VirusTotal.

Specific Parameters
Some vendors intentionally make their VT engines "less aggressive" to avoid reporting false positives to the public.

The Golden Rule
VirusTotal is a tool for research and context, not a replacement for a real-time antivirus. A "clean" result on VT does not guarantee a file is safe.

 

[Khushal]

Ok

once again proved VT is not reliable.

it is just a sus object npt confirmed malicious

 

[SeriousHoax]

it is just a sus object npt confirmed malicious

Anything blacklisted by Livegrid = Suspicious Object. That's the name they use for it, like UDS for Kaspersky's Cloud.
Looking at the behavior on VT, it seems that this sample is something that will be detected by a lot of AVs when the sample is run but I'm not sure of course, since it also seems to load a vulnerable driver. The relation tab shows two vulnerable drivers, one of which is detected by ESET only. The other one is also an old one but not detected by well-known AVs at this time.

 

[SeriousHoax]

Anything blacklisted by Livegrid = Suspicious Object. That's the name they use for it, like UDS for Kaspersky's Cloud.
Looking at the behavior on VT, it seems that this sample is something that will be detected by a lot of AVs when the sample is run but I'm not sure of course, since it also seems to load a vulnerable driver. The relation tab shows two vulnerable drivers, one of which is detected by ESET only. The other one is also an old one but not detected by well-known AVs at this time.