Attackers have been using legitimate online services such as VirusTotal and others to check their new pieces of malware against various security suites for some time now. Now, the creators of some exploit kits are beginning to include less well-known, underground malware-checking services as part of their offerings to buyers of their kits. The services typically are anonymous and many of them are free, so they re easy for the attackers to use. It s a handy way for users or admins to ge a quick answer about a suspicious file.
Source: https://threatpost.com/siberia-exploit-kit-offers-service-evade-anti-malware-software-120110/74719/