AV use other methods, except for signatures, for example running code in the sandbox or heuristics. If the malware was not obfuscated then it could be detected

AV use other methods, except for signatures, for example running code in the sandbox or heuristics. If the malware was not obfuscated then it could be detected even without signatures. But of course if I were installing an AV product I wouldn't like it to send my files anywhere.