I'd say it's a false positive introduced by a recent definition file for Avira as per usual - I just checked and downloaded the current Shup_install.exe, which is bit-identical to the file I downloaded last year, then I updated Avira and it started bleeping in my downloads folder. This time it's not only the usual false heuristics alert though, it really seems to think it found something. Anyway, if there was malware on board it did a really crappy job in the past few years.