How am I supposed to interpret a VirusTotal result of "some engines think this is malware"? [closed]

Question

I just scanned another installer/EXE with VirusTotal. I've come to depend on this crappy service owned by the evil Google, in spite of its ambiguous messages and extremely confusing interface, because I don't have any other choice.

But I never feel confident about the result, especially not when some engines DO detect malware:

https://www.virustotal.com/gui/file/2c70ef057e6810f0b848bc6bac2df216d711c97699d67fb76f144230532472e7/detection

"F-Secure" says it's "Trojan.TR/Dropper.Gen", for example. Why would it say that? What makes it falsely (?) report that when other vendors say it's clean? Does this mean that if I were running and paying for "F-Secure", I would sit there with warnings on my screen and it would not allow me to install the program without jumping through hoops?

And "Cynet" says "Malicious (score: 85)". So it's 85% sure that it's malware? That makes me 100% unsure about it.

I find that my "Windows Defender" virtually never reports that anything is malware. I don't know if that's a good or bad thing.

Maybe I should stop using it entirely, because I never really trust the results or know how to interpret them. Sometimes, many/most report malware even though it doesn't seem to be, for example Bitcoin Core downloaded from the "official" website(s).

I don't understand how any "normal" person could ever have any use of anti-virus software and VirusTotal, because I'd likely be considered a "poweruser" with decades of computer experience and many years of worrying and trying to desperately figure out how to stay secure, and "even" I feel absolutely lost and essentially must blindly trust that it doesn't contain trojans and spyware.

(Let's not get into the topic of Windows 10 itself...)

PS: I'm aware of Qubes OS, but it has too many technical and practical problems to be seriously considered for somebody like me who only can fit one physical computer in my limited living space.

Answer 1

If it's a legitimate Windows software program, then it should be signed by the publisher using a Microsoft Authenticode certificate. Signing certificates can be purchased relatively inexpensively from many of the same CA's that issue SSL certificates, so there is no reason that even a small software development company would not have one.

If the installation program was signed using a valid Authenticode certificate, Windows will show show you information information about the signature (including the same of the publisher, etc.) when you run the installation program, and give you a chance to confirm. This also confirms that the installation program hasn't been tampered with since it was signed. If installation program hasn't been signed, or if the signature is invalid, Windows will warn you. In this case, if you choose to proceed, you are doing so at your own risk.

Added Sep 2, 2020: As pointed out by K4M and Steffen Ullrich in the comments, there have been a number of code signing CA's that have been compromised or coerced into issuing fake certificates appearing to belong to legitimate companies. This has resulted in malware appearing to have been signed by these companies, but in fact signed using these fake certificates. Therefore, it is not enough to simply check that the program has been signed, you must also check that the program has been signed using a certificate has been issued by a reputable CA. Code signing certificates are no different than any other PKI model - a chain of trust is necessary, as Steffen Ullrich so eloquently points out in the last paragraph of his answer at Can SSL certificate (domain verification) process be eliminated?.