  I'm sure it has to do with it not being signed, but you can use SHA256 hash verification to mitigate further false-positives.