I think I understand how does signature-based detection work (calculate hash -> compare it with the database of hashes), but I can't understand why some AV engines find the same virus as different.
As you can see VirusTotal show me that malware I used for researching is Trojan-Gen, WannaCry or Worm. Why different AV engines find the same malware as different.
Those results are what each vendor has chosen to call the malware internally. There is no standard form of naming a malware type.
Because of the different ways that vendors seek out and classify malware (and no, it is not always signatures), there will be differences in the ways that a vendor classifies the malware. If it can positively identify it as a certain malware (like Wannacry), then it can give it that label. If it is only classifying what it does, then it will give it a label based on its behaviour, like "ransomware", "trojan", etc.
I see one in that list where it looks like it just reported how it determined that it was likely malware without classifying it at all.
... calculate hash -> compare it with the database of hashes
That's a bit too oversimplified. Modern AV need to do way more than just computing a hash on a file in order to stay effective. But this is not your question and there actually several questions with good answers about this topic on this site.
Why different AV engines find the same malware as different.
There is no central malware database where every malware creator must register his malware with a unique name and all AV vendors will follow this naming (although this would make detection much easier). There is also not some kind of "malware name" property in files where the author of the malware has to embed the name. Instead different vendors come up with different names for the same malware. Also, they use different heuristics and some of the names just reflect the kind of heuristic which marked the file as malicious.
