Hash Value not detected by Palo Alto Engine

Hi -- Thanks for your response.

What is my query is that, We have received a report from one of the Vendor stating that with a list of Hash value's. Since all this are Malicious file type Hashes and need to take preventive action on our end.

So when we cross checked all the given Hash value by the Vendor on both VirusTotal and ThreatVault. We end up with some of the Hash value are not having an active WildFire/AntiVirus signature but at the same time in Virus Total that hash is detecting it as a *Malicious*.

My question here is, why for the same Hash value VirusTotal is giving this verdict as Malicious and ThreatVault isn't show it as Malware and also no AntiVirus Signature. Because of this we have bit curious on how to take preventive action for the earlier mentioned Hash Value's on our Firewall. Hope you got my query now I suppose.

Best Regards,

Sahul Hameed

There could be several reasons that the hash is not included in ThreatVault: the files may not have been 'seen' by any WildFire enabled devices, hence no verdict is available.

They could have been rolled up into a different/generic signature that covers the trojans but is not listed as the hash, since the hash is only used (by WildFire) to identify a specific file, but the same trojan may be injected into many different files.

for a conclusive answer on your question I would recommend reaching out to Palo TAC as they can check their backend servers to see if this file is identified differently, or is missing

hope this helps

@Reaper Yes, Thanks for your effort on this.

Will reach out to PA TAC for further analysis.

Best Regards,

Sahul Hameed