vlc.exe marked as W32.975C0D48C4.RET.SBX.TG

[brentb2529]

False positive?  Just got a bunch of these off multiple MXs.

MD5 : 346cac4d1166ef87ab7617fc977f7dd4

SHA-1 d4bf1fc804bef6293d867c5f250191860044639c

SHA-256 975c0d48c41d2ad76a242d5f7270f4bf8063bb9c753b375ab2c47c9e2060f562

Vhash 3872fcc78e34962257f24cc7728ffae1

SSDEEP 12288:ytHbQKCiPwXtnn9X25lauYsoRy5T9LlHbAlZ2A1w/ccW9ZbGwHbK+L65E7heqTxm:GhPwXtn9X25lvoUna2/clhK+L3EqRzi

TLSH T1F41512D014A648EBC530523EDC105E32B8A214885FB157F473F2B56EDADADB8E056FCA

File type ZIP

Magic data

TrID MSIX Windows app package (84.1%)   ZIP compressed archive (12.6%)   PrintFox/Pagefox bitmap (640x800) (3.1%)

File size 885.40 KB (906653 bytes)

Processes Tree: 4008 - VLC

Endpoint: 

1d.tlu.dl.delivery.mp.microsoft.com

SHA256 : 975c0d48c41d2ad76a242d5f7270f4bf8063bb9c753b375ab2c47c9e2060f562

Disposition : Malicious

Type : ZIP

Size : 906653 bytes

Thanks.

[Ken Stieers]

yep, FP, they just cleared that one.  

[Jeff Cooper]

So what is it?  I got 5000 emails from a customer across their entire network.  We had to shutdown FMC altogether.  What's going on?

[Ken Stieers]

IIRC that's VLC

Root cause for "what is going on" isn't done yet... I'll post it in the community if it gets sent to me. 

[pmedinac]

I'm wondering which SHA-256 are you getting alerted?

Also if this matches the initial one, I would suggest you open a TAC case with FMC, since this SHA-256 is already marked as clean, and probably is not being populated to your device, correctly.

SHA-256: 975c0d48c41d2ad76a242d5f7270f4bf8063bb9c753b375ab2c47c9e2060f562

--

Pedro M.

[Damon Kalajzich]

This appears to have killed my FMC, I have awoken to the /Volume being 100% full and FMC not functioning.