Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1040493" data-attributes="member: 99014">Definitely, similar case was discussed by malwarebytes for example as well:[URL unfurl=&quot;true&quot;]https://forums.malwarebytes.com/topic/290657-false-positive-malwareheuristic1003-virustotal/?do=findComment&amp;comment=1535752[/URL]It has been discussed by other vendors as well. VirusTotal is not an indicator what actual products will detect.This is something to do with the machine learning models. Locally it extracts the so called “bag of attributes” (bagging) if the cloud is not certain already what this file is. These are processed in the cloud and verdict is issued as an output.If it erroneously classifies malware as PUA it may be that the models are not extremely certain this is malware and output low confidence (which automatically falls into the PUA threshold) or maybe there are specific aggressive models against PUA that “caught” the malware.If the genotype analysis itself outputs PUA label, then it’s been “overtrained”, perhaps the training sets of PUA wrongly contained malware and it extracted features relevant to malware.Sophos in many cases will output 2 detections (it is the only one I’ve seen doing that) delimited with a + sign. I’ve not given it a proper thorough test to say more. I am not in love with Sophos to be honest.</blockquote>

[QUOTE="Trident, post: 1040493, member: 99014"] Definitely, similar case was discussed by malwarebytes for example as well: [URL unfurl="true"]https://forums.malwarebytes.com/topic/290657-false-positive-malwareheuristic1003-virustotal/?do=findComment&comment=1535752[/URL] It has been discussed by other vendors as well. VirusTotal is not an indicator what actual products will detect. This is something to do with the machine learning models. Locally it extracts the so called “bag of attributes” (bagging) if the cloud is not certain already what this file is. These are processed in the cloud and verdict is issued as an output. If it erroneously classifies malware as PUA it may be that the models are not extremely certain this is malware and output low confidence (which automatically falls into the PUA threshold) or maybe there are specific aggressive models against PUA that “caught” the malware. If the genotype analysis itself outputs PUA label, then it’s been “overtrained”, perhaps the training sets of PUA wrongly contained malware and it extracted features relevant to malware. Sophos in many cases will output 2 detections (it is the only one I’ve seen doing that) delimited with a + sign. I’ve not given it a proper thorough test to say more. I am not in love with Sophos to be honest. [/QUOTE]

Verification