The SHA256 of the file on virustotal matches that in the SHA256SUMS.asc file, so the download is legitimate. The executable is fine and safe. The detections on virustotal are false positives. Bitcoin Core is often flagged as a virus because it looks for a wallet.dat file (so usually considered a coin stealer) and it contains mining logic (so also considered a bitcoin miner). These are true, but are also integral to Bitcoin Core functioning properly; it is the software the makes the wallet.dat file that many viruses try to steal. It also contains logic for mining blocks, but this is only for testnet and regtest networks now. If you have verified that the sha256 of the file matches the sha256 in SHA256SUMS.asc and you have verified the PGP signature in SHA256SUMS.asc, then the file is safe and not a virus.