How does antivirus work?
solutions start by comparing potentially dangerous code to a set of patterns
and rules that make up the antivirus definitions, which match known malicious code. Antivirus definitions are updated regularly as new malware is
identified by each vendor. This sort of identification is called static analysis. In addition to static analysis against a set of signatures, more advanced
antivirus solutions also test for malicious activity, called dynamic analysis.
Static analysis is performed in a non-runtime environment. Typically a static analysis tool will inspect program code for all possible run-time behaviors and seek out coding flaws, back doors, and potentially malicious code.
Dynamic analysis adopts the opposite approach and is executed while a program is in operation. A dynamic test will monitor system memory, functional behavior, response time, and overall performance of the system.
This was just a brief overview of how they make up their definitions. Whenever they receive new sample, they analyze it and update their definitions. So how fast definitions are updated by vendors may differ and if a particular malware gets popular all of a sudden you will find that it will be detected by maximum antivirus. So It all depends on the vendor and their consistency.
So there is no saying which antivrus do their job best. You can also upload your files at NoDistribute and check how many AV were able to detect it.