Usually, I would guess on FP with this dedection rate.
But since you posted the obfuscated gzip file… :-\