Nice review.
1. AV signatures will depend on the type of detection method; most products use SHA-1 or SHA-256 for the static database of checksum detection methods as opposed to MD5 these days. Some AM products like Xvirus Personal Guard still use MD5 however it's not as secure as SHA-1/SHA-256 so it's not as used anymore. You have static heuristics which will include signature-based detection based on the bytes within the PE, and other factors which are not signature-based in itself, such as scanning the PE File Header, Import Address Table, and calculating the entropy, etc.
2. Emsisoft Anti-Malware/Internet Security will only query the program for the Anti-Malware network once suspicious activity has been found - they do this for the user's privacy and to prevent system slow-down, since if they checked the cloud for every single program then there'd be a performance impact and they'd know which programs you were running and the time, etc. Therefore, when the BB/HIPS finds something suspicious, it'll query it and depending on the cloud result will depend on if an alert will be shown or not. (I assume this is how it works at least).
That's all I have to add.