Hell, I've seen F-Secure classify Firefox on OSX as malware. I would assume such common software binaries would have their hashes whitelisted or something.