Is this a strange virus?

First of all the file is signed by Comodo RSA Code Singing CA, I am sure if they just use the name Comodo. and the signature is to TOV FLOUTEK.

The file information will show you that it is CCleaner and Copyright to Piriform LTD. Although it supposed to be a firmware for a camera.

Every time I download the file, it will get a new signature date with the time I downloaded.

File link: hxxps://docs.google.com/document/d/1nFzSdThI_nMcQEDi7KcOLXJKRamRtnN1HGnS2NCNIZw/edit

Every time I upload to virus I get different results, though it is just heuristic.

Here are 2 examples:

The virus will integrate into the windows system and change some of the links, didn’t try it though.

Edit. I broke the link to protect less experienced users. Eric

Hi,

Thank you for reporting this.
We’ll check it.

Kind Regards,
Erik M.

Thanks,

Still strange, the files from yesterday give me now 19-20/65 detection rate. it was yesterday 7-8/65

I downloaded the same file today it gives me 9/65 VirusTotal

Why is that? I mean I know it is heuristic, but it is the same virus, shouldn’t be detectable every time?

Hi paradis_pal,

Thank you for reporting this.
We’ll check it.

Best regards
Abinaya R

Now the file has different size and information, I guess it is another virus, bet still signed by Comodo.

Hi paradis_pal,

Thank you for reporting this.
We’ll check it.

Best regards
Ananthalakshmi M

Thanks,

Now the new virus get different detection rates

The first upload one gets now 23 / 67 VirusTotal

While the new upload gets 13 / 67 VirusTotal

it is the same virus,m why different detection rates?

Viruses develop so when a newer version gets released the cat and mouse game with AV scanners starts.

Hi paradis_pal,

Thank you for reporting this.
We’ll check it.

Kind Regards,
Qiuhui.■■■■

I get that, but not within seconds, it felt like HIV ;D

Now new form

Then I guess it is a polymorph type of virus.