Actually my Windows Defender picked it up and gave me this: Trojan:Script/Wacatac.B!ml. Idk why it picked it up for this file but not the other ones from Workupload. The Ahri one did not get me a Virus warning, but it did for another user here.
Well then I'm out of ideas why it happens. The other user confirmed the issue did not repeat and when I scanned the link at the time it was clean, now one scanner picks up something. Maybe it got updated in the meantime and is more aggressive but its still only 1/98, very likely false positive.
You must be registered to see the links
You must be registered to see the links
The links to files on host get picked up by one scanner
You must be registered to see the links
You must be registered to see the links
but the files themselves are not. You can always confirm the scanned file is the same one as on host by checking the SHA256 shown there. Or checking SHA256 of the file download by running
Get-FileHash "filename" in Windows PowerShell or
sha256sum "filename" on Linux. Or just throwing the file into
You must be registered to see the links
directly yourself. Just downloading the file will not run it nor decompress it on its own after all.
Edit: I also checked other links and that one scanner is picking up something on literally every Workupload link, even on the links from OP, so there's definitely something funky going on with that scanner or with the host itself.
You must be registered to see the links
You must be registered to see the links
You must be registered to see the links