

Yeah, those are just false-positives, they think they are suspicious or malicious, but they are not. VirusTotal uses 70+ scanners to check the URL or file. The best way to think about it is that since the majority of the scans show it as clean, it is most likely to be safe. If there are several scans showing it as malicious, it probably has something that isn’t safe.
This is accurate when using the BT protocol. However if you have uTP (Micro Transport Protocol) enabled, it has “support for NAT traversal using UDP hole punching between two port-restricted peers where a third unrestricted peer acts as a STUN server.”