Low quality rogue

[SeriousHoax]

Detected before even download?

Yes. Bitdefender has a signature for the rar file for some reason. Probably created by their automated signature creation system. I also checked by disabling its protection and extracting the rar file. BD didn't detect the setup file. Weird. Then I ran the installer and then the main app exe extracted by the installer on the installation folder was detected by Bitdefender instantly. It was a cloud-based detection. I also then tried by changing the hash of that sample. This time BD also detected it but with a slightly different cloud-based detection name. So, the cloud-based detection was not purely file-hash based detection which is nice.

I think Avira better than Avast even after acquisition.

No, it's not. Avast is a much better product overall. Keep in mind that this file is a joke program. It's not a malware.

 

[XylentAntivirus]

Advanced File Analysis System | Valkyrie According to human analysis it's clean.

 

[Trident]

So, the cloud-based detection was not purely file-hash based detection which is nice

It could have been some fuzzy hash.

 

[XylentAntivirus]

I forgot to say but Microsoft Edge blocks that file even if before I post this.

 

[SeriousHoax]

It could have been some fuzzy hash.

Yeah, possible. This is the first time I have seen BD's cloud-based detection didn't have any impact on changing hash, so this was new for me.
"Gen:Suspicious.Cloud.2.in0@auezHOh" for the main file.
"Gen:Suspicious.Cloud.4.in1@auezHOh" for the hash-changed file.
Edit: Just now checked again slightly differently with another new hash.
This time I activated BD's real-time protection when the malware was already running. Detection name via the scanner was the second name I wrote in this comment while detection name for the running malware by the real-time protection was, "Gen:Heur.Zatk.in1@buezHOh"

 

[andytan]

Trend Micros behavior blocker stops it and deletes the file once executed.

 

[struppigel]

Locked threat because it is off topic