I suspect it's a combination of the fact that:

* MMF2 generated executables are executables with data appended to the end (that isn't in the EXE header)

* The data that's appended includes ZLIB compressed extensions, which are extracted at runtime

It's pretty common for a virus to hide code in an EXE in this exact way, so it's not surprising MMF2 EXEs keep getting picked up.

It's a bit concerning that certain antiviruses seem to have viruses actually called things like "win32/Adware.Clickteam". I suspect Install Creator's wide usage is to blame for this.