It&#x27;s likely they are using an engine based almost entirely on run-time heuristics - that is, stopping malware when it behaves suspiciously. VirusTotal does &quot;scan-time&quot; analysis of files where the file is never run, only checked against AVs. If they have no &quot;traditional&quot; signatures, they wouldn&#x27;t be compatible with this method.