installer for Zim-Desktop (open source) flagged as Malware.AI.235572802

[aschw22]

The day before yesterday i successfully downloaded and executed this installer for Zim Desktop, some well-maintained open source program (Link and file details below) on our machine. This was while Malwarebytes was running real-time protection. Today Malwarebytes complained about the installer file in the Downloads folder (not the installed program).

Downloaded Oct. 26 2022 from https://zim-wiki.org/downloads/zim-desktop-wiki-0.75.1-setup-w64_x86.exe Size: 21594580 Bytes (20 MiB), SHA256: 10349F19C4C35296D4E267A25E0203219ACCBCAC72CD3ABBDD4C7CE65586FB48

Output Malwarebytes:

Malware.AI.235572802, C:\USERS\XYZ\DOWNLOADS\ZIM-DESKTOP-WIKI-0.75.1-SETUP-W64_X86.EXE, In Quarantäne, 1000000, 235572802, 1.0.61641, 7DEAD7E032FD208A0E0A8E42, dds, 02010753, 3660D6BCBE105E4C2B96D168FB984B12, 10349F19C4C35296D4E267A25E0203219ACCBCAC72CD3ABBDD4C7CE65586FB48

I uploaded that file to virustotal: https://www.virustotal.com/gui/file/10349f19c4c35296d4e267a25e0203219accbcac72cd3abbdd4c7ce65586fb48/detection

In public forum, people suspect some malware used MSYS2 which triggered AI to flag this. Also, there was a similar case some 5 ys ago. https://github.com/zim-desktop-wiki/zim-desktop-wiki/issues/2214

[cli]

Thanks for reporting, I scanned the file and it is not detected locally. 

Quote

These discrepancies typically solve themselves over time, as our files processing and engine training backend picks these files up and marks them as goodware, and VirusTotal clears their cache and re-scans those files.

For more information, please read  VirusTotal-only detections, not detected in Desktop product.