Potential match ID 3029072c item not found

[ruivlea]

Is this false positive?

Malware Detected: Potential match
File: /system/priv-app/SamsungContactsProvider/SamsungContactsProvider.apk
ID: 3029072c

Item not found on https://www.virustotal.com/gui/file/3029072cbe0b4fff10c7ee8b4cab8ae4242a9268ef3334618e9ed055b54b813f

[SkewedZeppelin]

If it isn't found on VirusTotal it is highly likely to be a false positive.

[ruivlea]

ClamAV does not detect it as infected. Why does Hypatia detect it?

clamscan SamsungContactsProvider.apk
Loading: 21s, ETA: 0s [========================>] 8.70M/8.70M sigs
Compiling: 5s, ETA: 0s [========================>] 41/41 tasks

/home/ruivlea/isolation/SamsungContactsProvider.apk: OK

----------- SCAN SUMMARY -----------
Known viruses: 8697684
Engine version: 1.3.1
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 18.47 MB
Data read: 3.25 MB (ratio 5.68:1)
Time: 41.090 sec (0 m 41 s)
Start Date: 2024:08:25 08:36:16
End Date: 2024:08:25 08:36:57

SamsungContactsProvider.apk sums:
MD5 = 2e2f5a5df2e22b32c77225efa158e752
SHA1 = a413caf3db857793ccfb5dc89bd6bb93555ff653
SHA256 = 3029072cbe0b4fff10c7ee8b4cab8ae4242a9268ef3334618e9ed055b54b813f
SHA512 = d6618ecce88b544bc0a3f1b2a390c1e7c2bc8211cb7798f0732b6925b486487dcf52617972c65befe179c42c31dc605675770ea05440641e15b32aebcbb1e6b5

[SkewedZeppelin]

because the database is a bloom filter which is probabilistic, it itself inherently can false positive

https://en.wikipedia.org/wiki/Bloom_filter#Probability_of_false_positives

here is the rate for today's database:

Expected false postive rate: md5: 5.894939297041924E-7, sha1: 1.0225898672608628E-6, sha256: 3.4877997651359615E-7