How to submit samples of suspicious files/ false positives to Sophos (Troubleshoot)

0
(0)

Overview

There are several reasons why a sample should be submitted to Sophos. Use instructions on this page in the following situations:

  • A strange behavior on the computer was experienced and a suspicious file that may be malware was found
  • Another anti-virus product was used that reports the file was infected and you’d like to double-check the results or report the failure to Sophos
  • A Sophos product has given a warning that a suspicious file was found on the computer but it does not tell for sure if it is safe
  • Sophos has asked you to submit a file, either during malware investigations or on the security descriptions page
  • You believe the detection of a certain file/website is incorrect and needs to be reassessed. 

Sophos will process personal data submitted to these email addresses in accordance with our Privacy Policy.

Submit samples directly to Sophos website

The quickest and most efficient method of submitting samples for analysis is to use the online submission form from the Submit a sample page

  1. Click Submit a Sample followed by Sample File
    (To report a website choose Web Address (URL) – Choose either Endpoint protection option for product/service)
  2. Provide the required details and sample files / website url
  3. Click the Submit button.

This form enables you to give Sophos all relevant information on your sample. This will help us to analyze it with maximum speed and efficiency.

Note for URL submissions: Submitted URL categorization requests will be reviewed and re-classified as quickly as possible, though it may take up to five business days once a site has been re-classified, for it to be available on your Sophos product.

Notes:

  • Explain why you have sent the file and who sent it. Please tell us about any odd behavior that prompted you to send the sample. Describe it as best as you can, using everyday language. We don’t expect you to know the technical language used by our specialists.
  • There is a 30 MB file size limit on files submitted directly to our website. If the file is too big, please include a message asking for additional upload options AND/OR  send a download link from the official vendor’s website. 

Submit samples via email

If possible, construct the email as outlined below using the English language.

  • Between your system and ours are there many forms of malware protection. The files you send must be able to pass between the systems without being detected as malware. Therefore, before sending us a suspicious file, create a password-protected zip file containing the suspicious files. We can process email messages and submitted files in other formats, but this will probably take longer.
  • If you can, include a summary of the problem in English. Email messages written completely in other languages will be dealt with as rapidly as possible, but translation may delay the process.

Headers

Message Headers Information
Subject Sample submitted for analysis
Note: If a reply from Sophos is not needed, add no reply needed in the Subject. For example, Sample submitted for analysis - no reply needed.
Recipient (To:) [email protected]
Attachments Make a password-protected zip file containing your suspicious file(s) and include it in the email. If Windows (for example, for Macintosh, Linux or UNIX) was not used then use the standard compression format for that platform like Stuffit, gzip, etc.  

Body

Email body Description
Why have you sent this sample? What was it that made the file suspicious? Give full details of any symptoms. For example:

  • What caught your attention about it?
  • Where did it come from?
  • Has another anti-virus program detected it as a virus?
  • Have you noticed excessive traffic on your internet connection?
  • Has your browser been behaving strangely?
Operating system What operating system, for example, the version of Windows, is the affected computer running?
Your details Please provide the following details:

  • Name
  • Job title (if applicable)
  • Organization (if needed)
  • Country
Password Password to decrypt the attached password-protected zip file.

Additional threat resources

For more information regarding threats , vulnerabilities, PUAs, and more, please visit our threat center
Scroll to the bottom section to find threat categories to choose from, or feel free to search for any specific threat.  

Source : Official Sophos Brand
Editor by : BEST Antivirus KBS Team

How useful was this post?

Click on a star to rate it!

Average rating 0 / 5. Vote count: 0

No votes so far! Be the first to rate this post.

(Visited 25 times, 1 visits today)
Tagged: