When VTotal gives you FP results days after a new release. Making the call

[soccer97]

I use a password manager that recently released a new version (the old one was crashing and causing issues). I have 150+ logins in there (or I'd wait). VirusTotal gives me a 3/56 result. Since the vendors aren't major ones, I assume it is perfectly fine to disregard the 3/56 result and assume the file is clean? It was downloaded from the official site.

Results
Antivirus scan for d38f552d4e1e57ddf5dfbba1c7f798a64596deb0714812558b45a2f4bc125c36 at 2016-04-10 00:39:30 UTC - VirusTotal

Metadefender Cloud

These show it as more potentially malicious:
Latest Submissions · Free Automated Malware Analysis Service - powered by VxStream Sandbox

Waiting on Comodo:
Comodo Instant Malware Analysis


Since the major vendors are OK with it, I can safely assume it's a FP, correct? (the vendor is closed for the next 72hrs. New laptop, otherwise I would wait.

Thanks!

 

[Dirk41]

Free Automated Malware Analysis Service - powered by VxStream Sandbox
https://malwr.com/

Just out of curiosity, try those websites. I read on MT that are better than VT. I am not an expert anyway

 

[soccer97]

Free Automated Malware Analysis Service - powered by VxStream Sandbox
https://malwr.com/

Just out of curiosity, try those websites. I read on MT that are better than VT. I am not an expert anyway

VXStream result was attached to post, and Malwr file size limit is 5mb. This file is 29mb.

Not sure if CAMAS (Comodo Instant Online Analysis) works or not. It's been 40 minutes.

 

[Dirk41]

Sorry I read VT..

 

[Deleted member 2913]

VXStream result was attached to post, and Malwr file size limit is 5mb. This file is 29mb.

Not sure if CAMAS (Comodo Instant Online Analysis) works or not. It's been 40 minutes.

Instead of CAMAS, try Comodo Valkyrie Advanced File Analysis System | Valkyrie

 

[hjlbx]

Solution is simple... when in doubt, don't use file. Wait some time - a few weeks at least - and then check again.

If you allow it to execute on your system, then all bets are off.

Run it in sandbox, virtual session or virtual machine. Even then you can't always be sure it is safe.

Also, look at vendors who are detecting; some are better at identifying malicious files than others.

Kaspersky is better than Aegis, for example. Some vendors are much more prone to heuristics false positives.

As @yesnoo points out, use Valkyrie... and wait 6 months to a year for manual technician reply... LOL.

I recommend Dr Web for manual analysis.

I use 5/* detection rule, and then also look at which engines are detecting.

If I have doubts, I don't execute.

 

[Deleted member 2913]

As @yesnoo points out, use Valkyrie... and wait 6 months to a year for manual technician reply... LOL.

The auto analysis is good too. And you get file & other info. I never wait for manual analysis.

 

[Deleted member 2913]

Sorry, you will not be able to upload to Valkyrie. File size limit is 25MB & the file in question is 28MB. I just tried & let you know.

 

[Deleted member 2913]

Ok, I used Valkyrie "check with url" option.
Valkyrie final verdict - Clean

Report here -
https://valkyrie.comodo.com/file/export/pdf?sha1=aec828e428597071622b556fde69b65c7cc61068

 

[Atlas147]

I think if you are really suspicious of the file then send it in to the AV vendor you use, eg if you are using ESET send it to the ESET undetected malware link so they can analyse it and give a verdict if it's malware or not.

Who knows, maybe your password manager's site was hacked and the update was swapped with a malware sample, and you could be the one reporting it to the rest of the vendors.

Normally I would run the program in a sandbox when in doubt, but seeing as this program manages your passwords I think it woudn't be a good idea to run it even in a sandbox. Either continue using it without the update until you can be sure, or change your program to another one with a better reputation.

 

[soccer97]

I think if you are really suspicious of the file then send it in to the AV vendor you use, eg if you are using ESET send it to the ESET undetected malware link so they can analyse it and give a verdict if it's malware or not.

Who knows, maybe your password manager's site was hacked and the update was swapped with a malware sample, and you could be the one reporting it to the rest of the vendors.

Normally I would run the program in a sandbox when in doubt, but seeing as this program manages your passwords I think it woudn't be a good idea to run it even in a sandbox. Either continue using it without the update until you can be sure, or change your program to another one with a better reputation.

I reported it to Ikarus and the vendor, will wait till I hear back. Not worth the compromise. Thanks!

 

[jamescv7]

Even though Virustotal implement the mechanism to check if the file is a benign from those malicious detection hence you need to be vigilant on the file.

Number one way is to determine the location of the file then next test for suspicious behavior if you think its been likely altered.

 

[Rishi]

Try this : Free Malware Analysis Sandbox - ThreatTrack Security submit the file + VT results to the Password manager vendor as well as to your AV company for further analysis. If results are inconclusive, wait it out.

 

[Ana_Filiz]

Instead of CAMAS, try Comodo Valkyrie Advanced File Analysis System | Valkyrie

How is this Valkyrie, it is worth to be installed? Anyone tried it? It looks promising.

 

[hjlbx]

How is this Valkyrie, it is worth to be installed? Anyone tried it? It looks promising.

It is freeware. You submit files through the Vakyrie webpage. You will get automated file verdict, but manual analysis by technician comes later. It used to take up to 6 months.

You can also use Cuckoo sandbox and Hybrid-Analysis online.

 

[Parsh]

Talking about Cuckoo sandbox, my Avira extension blocks its download link indicating it's a Malware website.
I could analyse the file after download, but not sure about the url, though secure. Is it safe to proceed with the download (is this the right malwr cuckoo?)?

 

[Zero Knowledge]

If your VT results are from low level fringe Av's I wouldn't worry. It's probably false positive.

But if Norton, Kaspersky, Emsisoft, CrowdStrike are flagging it as malware I would stand up and take notice.

 

[soccer97]

Thanks to all. I have learned several lessons: When viewing VirusTotal results - look at the reputation of the vendor when judging a file's legitimacy.

VTotal may not be up to date/correct and it can take a few days for it to detect a virus in a file, or it may be reported as a FP for a few days and have to be corrected.

Hybrid-Analysis was useful. The vendor is a trusted one - and I was pretty sure it was either a FP flag or a mistake. My speculation is that it was due to inclusion of a new/different auto-fill engine that may have set off alarms. All is good. I waited a week before installing it.

Thanks to all who mentioned the above resources. They could be added to the community as in what to do when you find a FP/Report a malicious file section.

Short version : False Positive due to unknown reason. Resolved.