Not every file an antivirus program flags is malicious. Even clean files can be flagged as a virus if they behave like viruses in the eyes of antivirus programs.
Basically, antivirus programs use two methods to identify a virus. These are Heuristics and Signature-Based Methods.
Heuristics Method
The heuristic or behavioral analysis method is regarded as a better antivirus program than its counterpart - the signature-based program. Unlike the signature-based program, it doesn't rely on bytes pattern previously catalogued as a virus. In other words, it doesn't rely on signatures or already catalogued bugs.
It instead relies on the behavior of a file. If the file possesses any behavior of a vulnerable class like Cross-site Scripting (XSS) and SQL Injecting, it immediately flags it as malicious. This is great and this quality makes it better than the other method.
However, even this is not perfect. Actions, which are not malicious, may be faulted as malicious simply because they "behave" like a malware. In other words, files that use identical compression and protection techniques the viruses use risk being flagged even though they are clean.
Signature-based Method
This method relies on signatures of previously catalogued malware to decide whether a file is malicious or not. Its database is updated frequently with signatures of previously declared viruses. This means it can't detect a virus if there's no signature of its (the virus') kind in its database. It also means it can erroneously catalogue a clean file as malicious if it identifies any suspicious signature. This is because Signature-Based Programs don't run additional security checks to verify. It just only relies on a flawed system - checking file paths and structures, version details, and version, making this method more prone to reporting false positives. Examples of Signature Based Programs are WPScan and Nikto.
What Next?
The VirusTotal.com website is a great place to scan your files as it uses a wide variety of different antivirus programs to scan for viruses. To be on a safer side, experts recommend that after the scan, if some of the programs flag your file as malicious, then it's better to dump it (the flagged file).
However, if most of the programs are okay with the file, then you may go for it.
If only one or two programs flag the file, then it's probably a false positive.
But all this isn't a guarantee. Nothing is 100% guaranteed. That's why you should consider the source of the file.
