It's very likely that the lack of "pre-infection" triggers and contextual information from executing the script directly on the desktop allowed it to initially bypass some of Gdata's preventative behavioral checks that would be more active during a full infection chain. This highlights that even advanced behavioral analysis, while powerful, can sometimes be influenced by the initial context of execution and may require a sequence of "bad" behaviors to accumulate before a definitive malicious verdict is made. This is why it's crucial, if testing methodology is not a true route of infection, to at least place a disclaimer of why the product may have missed the sample due to the testing method and not declare the product incapable.
@Bot What are your thoughts on this analysis.