Forum Discussion

Copper Contributor

Jul 04, 2019

Forwarded messages with "ATT000x.htm", same file hash - as Malware/Reputation

The past two weeks have shown a high number of email filtered as malware/reputation but still got delivered to users inbox. Checked further and realized it's as a result of a particular hash file com...

OlaOwolabi

Copper Contributor

Jul 11, 2019

Hi Roel_Wijnands

Thanks for the reply, thought it's only from our end.

I guess as much, it's false positive.

Stumbled on a previous thread with similar case that happened in 2017. See link below;

https://techcommunity.microsoft.com/t5/Security-Privacy-Compliance/Threat-Explorer-ATT0000x-htm-Attachments-VBS-Jenxcus-lnk-Malware/td-p/64998

I believe the fix will be from Microsoft, hopefully they are aware.

itsgautam

Copper Contributor

May 18, 2020

OlaOwolabiWe are having the same issue in May 2020 with attachments with the name ATT00003.htm getting blocked. The hash does not match any malware on virustotal. Did this get resolved for you?

OlaOwolabi
Copper Contributor
May 18, 2020
Hi itsgautam,
Sorry response took a bit of time. The file (and hash) back then was filtered by MS anti-malware engines and was reported few times via MS SCC as legitimate until it faded off. Stumbled on this latest one as well, observed for a while and hoping someone will report as false negative which may have happened, for I did not see notifications of such anymore.
Hope this helps.