I don’t really know what is flagged and why it’s flagged as PUP. Maybe it’s just the particular packed sample detected by the outer wrapper.

As for why VT removes the suffix - don’t know, I also find it unfortunate.