Why would the same SHA256 Hash of a file have totally different VirusTotal results at the same time?
Submitting a file to VirusTotal via File upload results in numerous hits for malware.
Submitting the exact same file but via URL submission results in a totally safe and clean submission.
I understand that these files are accessed in different ways, so AV software might look at the file in a different context, but ultimately the endpoint is at risk regardless.