It is a FP if the file does not contain OpenCandy … something that can be checked at VT