You are misunderstanding. WinRAR's implication is that the CA is lying about the 570 MB file because they didn't mention it until WinRAR challenged them on the VirusTotal justification for revocation, and because they were unable to provide the file in question or any evidence that it exists.
Why not at least link to the virustotal listing for said file? Perhaps someone else has it from the hash?
I doubt the CA would lie about the existence of such a file, although perhaps they are mistaken about the signature (it could be a case of a 570 MB file concatenated with a legitimately signed winrar executable - signatures don't always cover all parts of the file)
The WinRAR post doesn't say that the file was submitted to VirusTotal, only that the CA said it "looked like a file used by hackers". Either there was no VirusTotal record for it or there was and WinRAR omitted that fact because it weakened their argument.
Also this file (if it existed) was used to justify a business critical decision. Why wasn’t there a paper trail for this file. Why wasn’t this data archived?
