> (b) the collision problems of MD5 aren't really a problem here, as why would someone [] have an incentive to make their file falsely look like this malware.

> (b) the collision problems of MD5 aren't really a problem here, as why would someone [] have an incentive to make their file falsely look like this malware. While your overall point is correct, there is a specific tactic where a collision attack would be useful: make two md5-colliding versions of the virus that behave subtly differently, in a attempt to make researchers throw out useful hypotheses about how it works because someone already determined that (the other version of) it didn't actually do that.