7zip has virus/malware?

[shreesha345]

https://www.virustotal.com/gui/file/d140094f0277b49a4e895159bd734da03cd2b60fb73a65e4151edfedc612981e

it came to my understanding when I try to just put the exe to vriustotal it just showed me this.

[sebres]

It seems to be 7z25.01-zstd-x64.exe from latest release v25.01-v1.5.7-R1, but...

1. Only 4 from 71 tools detects it as something malicious, what can usually mean the file is slightly suspicious (a "grayware" or "PUP"), or just a false positive (what I currently guess).
2. It shall be the same executable as from this build, but I cannot check it again, because release binaries built there are expired now.
3. @mcmilk, where did you get it from as you uploaded it to the assets of release? Self built or that from P. 2?
4. If I try some later commit after the release, that is not expired yet, e. g. this build and upload this to virustotal, it causes this result, that also shows 4 detections.

So it looks like it would be indeed a false positive (something in the exe would be mistakenly detected as malicious) by that tools. Or toolchain on github actions or even my PC (where I downloaded, extracted 7z25.01-zstd-x64.exe and uploaded it to VT) has the same "virus" than @mcmilk PC. What I don't believe.
Alternatively we have something malicious in the codebase (what we didn't found by the reviews), but that's even less believable.
I still guess a misdetection (something inside, possibly even the zstd, brotli or whatever remembering that tools on some malicious bytecode or it confuses a heuristic of the tool in the way it'd be enough for a false positive).

[mcmilk]

I have no idea, but searching for virus or malware within the issues will show other false positives.

Maybe we should automate the 7-Zip ZS releases as well; this would be another step towards greater transparency.

[mcmilk]

2. It shall be the same executable as from this build, but I cannot check it again, because release binaries built there are expired now.

I create a new release and take the binaries from the github actions then. I download the zip to my linux system and upload it to the releases download page - so at my site, there is no windows included ;-)

[sebres]

Well, purely hypothetically there can be also a virus on linux box, but I compared the SHA256 of exe in the archive (e164eac3909a7c51...f0703bae89fe91f4) with SHA256 of virustotal, and since the archive is also "protected" by SHA256 on GHA (08ea9458d5256b38...c45594706f83accd) and it is equal on my side, the PC of me has also nothing on this. :)

Thus, and also because of earlier "duplicates" of the issue, the conclusion is - it's false positive... and I think we'd close it now.
I have no intention to check why a heuristic X of antivirus Y is cracking up, especially because they often do that on SFX-archives.