Honestly, I'd just whitelist it. But I've submitted it as a false positive to f-secure's response team (via https://www.f-secure.com/en/web/labs_global/submit-a-sample ) and hopefully they'll fix their DB (or give me actionable data...)