It could be a a false positive but just to make sure try scanning it online first, or maybe there's a way you could verify the checksum?