I am going to share some tips to help you know if a Virus Total detection may or may not be a false positive.
Obviously this is not 100% certain as there are many virus writers who leave their Trojans or other malware undetectable, but it can be a good start when in doubt.
Always before the slightest doubt, install the program detected as malware in a VM or Windows Sandbox and monitor its behaviour.
If you know some other ways other than these mentioned one, do share in posts below .
Here are the tips:
1) You got it from the official site, it's not impossible but unlikely to be bad
2) The antivirus that detects it is not one of the well-known ones, and it's the only one
3) Combine low detection rate with the age of the file (First Submission Time in the Details tab in VirusTotal): If it's a few months old, it's most likely clean. Old malware doesn't stay on low detection rates for that long.
4) Check the hash values of our download, we can go to the website of the developer of the program for which we have the installer and look for the MD5, SHA-1, SHA-256 code, etc. of its original installer. Once we have the two codes available, that of our downloaded file and that of the installer or software from the developer's official website, we can compare both and see if they match and our file is reliable or not.
5) Check if the file is signed and if that sign is valid. You also see that in the VirusTotal Details tab. Things like adware and unwanted programs can also be signed. But if you trust the company or organization that signed it, the file is most likely clean.
