After a long time, a sample still not being detected

[BrBrasil]

Hello guys,

I already submitted this file multiple time by the we interface, by email, etc... To no avail...

I dont know why this sample is not detected yet... Theres more than 1 month that I had submitted it.. I received in an email pretending to be from a bank... A lot of other avs already detect this...

Here is the sample:

http://www.virustotal.com/file-scan/report.html?id=a2d85de54ee60c8fc9a11e8c40ecfca532e837c6783f2ed9cf746273915c0ec3-1326119357

Thanks for your time,

BrBrasil

[polonus]

Hi BrBrasil,

Well avast has detection: http://www.virustotal.com/file-scan/report.html?id=e1ab0e32a4eaace5f5ac6764a6d9236caed2be12a0003ab4af01245ab040f553-1323332354
and here: http://www.virustotal.com/file-scan/report.html?id=e1ab0e32a4eaace5f5ac6764a6d9236caed2be12a0003ab4af01245ab040f553-1323332354
But there was also this malware W32/Trojan2.MHVF for -http://antarapos.com/js/
All dead now.....

polonus

[BrBrasil]

Hello Polonus!

Thanks for your reply.

But it seems that the reports that you put in your reply are not the smae file that I submitted yesterday. Their Md5 Hash are different, and their detection of the other avs.

Thanks!

Br_Brasil

[Milos]

Hello guys,

I already submitted this file multiple time by the we interface, by email, etc... To no avail...

I dont know why this sample is not detected yet... Theres more than 1 month that I had submitted it.. I received in an email pretending to be from a bank... A lot of other avs already detect this...

Here is the sample:

http://www.virustotal.com/file-scan/report.html?id=a2d85de54ee60c8fc9a11e8c40ecfca532e837c6783f2ed9cf746273915c0ec3-1326119357

Thanks for your time,

BrBrasil

Hello,
thank you for sendng sample. It is self-extracting rar archive - the file inside is already detected (if it runs and unpackes the file). But we have to analyze, why this archive is not unpacked when scanning.

Milos

[BrBrasil]

Oh, I understood now.

So this file would not be detected by a full system scan, only by executing it?

Thanks for the reply!

Br_Brasil