What does the bizarre text mean at VirusTotal?

Question

I downloaded Bitcoin Core from here: https://bitcoin.org/bin/bitcoin-core-0.20.0/bitcoin-0.20.0-win64-setup.exe

I then uploaded it to VirusTotal: https://www.virustotal.com/gui/file/0f1ea61a9aa9aba383a43bcdb5755b072cfff016b9c6bb0afa772a8685bcf7b0/detection

On that page, it confusingly says:

0f1ea61a9aa9aba383a43bcdb5755b072cfff016b9c6bb0afa772a8685bcf7b0 btcgenerator.exe

There is no btcgenerator.exe anywhere inside, and that file name is both very suspicious and seemingly malware. But has nothing to do with the installation file. Why does it show on that page? What does it mean by it? It doesn't have any context except just being there on the page with no comment/label, right underneath the equally confusing: "No engines detected this file"

Moving the mouse cursor over the "btcgenerator.exe" text makes it blue, as if it were a link, but nothing happens if I click on it and there is no kind of "title" or "tooltip" explaining what it means.

I've just about had it with VirusTotal and its endless nonsense, but AFAIK, there is no (real) alternative in existence.

Answer 1

I've just about had it with VirusTotal and its endless nonsense, but AFAIK, there is no (real) alternative in existence.

There is. You can verify the integrity of the file that you downloaded cryptographically, instead of relying on VirusTotal.

Take the SHA256 hash of the file that you downloaded. It should be 0f1ea61a9aa9aba383a43bcdb5755b072cfff016b9c6bb0afa772a8685bcf7b0 (it seems that this is what VirusTotal computed, but you might want to verify this to be sure). If that's the case, then you can rest assured that this is a legitimate file, because this hash appears in https://bitcoin.org/bin/bitcoin-core-0.20.0/SHA256SUMS.asc, and https://bitcoin.org/bin/bitcoin-core-0.20.0/SHA256SUMS.asc is signed with Bitcoin Core developers' private signing key (which you can verify using pgp and Bitcoin Core developers' public key at https://bitcoin.org/laanwj-releases.asc). In light of all of the above, it's highly unlikely that this is a malicious file.

Answer 2

On that page, it confusingly says:

0f1ea61a9aa9aba383a43bcdb5755b072cfff016b9c6bb0afa772a8685bcf7b0

This is the sha256sum of the file

btcgenerator.exe

There is no btcgenerator.exe anywhere inside, and that file name is both very suspicious and seemingly malware. But has nothing to do with the installation file. Why does it show on that page? What does it mean by it? It doesn't have any context except just being there on the page with no comment/label, right underneath the equally confusing: "No engines detected this file"

The file was uploaded to VirusTotal with that name by someone at one point.

At the details tab you can view:

Names (tooltip says: 'Names with which this file has been submitted or seen in the wild')

• btcgenerator.exe
• bitcoin-0.20.0-win64-setup.exe
• 0F1EA61A9AA9ABA383A43BCDB5755B072CFFF016B9C6BB0AFA772A8685BCF7B0.exe

Thus, someone uploaded it as btcgenerator.exe, and VirusTotal 'remembers' that this file has that name. Those may be useful, or pretty useless.

Moving the mouse cursor over the "btcgenerator.exe" text makes it blue, as if it were a link, but nothing happens if I click on it and there is no kind of "title" or "tooltip" explaining what it means.

It is a link to https://www.virustotal.com/gui/search/name:%22btcgenerator.exe%22/files (a search for files with that filename)