Idle speculation -- perhaps they run it in the sandbox to see if it appears to be malicious? I mean, it's kind of like doing crash-tests with live passengers instead of dummies, but I could maybe see somebody deciding this was a good idea.
I greatly enjoy this analogy.
But yes, watch The Prestige.
https://www.goodreads.com/book/show/13582015-think-like-a-di...
Maybe I'm just wrong about that and this is a standard technique for evaluating security.
that's literally what every antivirus is already doing though.
Turing's proof essentially says that there is no way to be sure of knowing what an arbitrary program will do except for running it and seeing what it does.
It's an imperfect technique for real-world programs, but so is everything. Think of it as being like static code analysis versus runtime "sanitizer" tools. Both are useful, and both can detect problems the other can't.
No, it's mostly a bullshit technique.
The thing is that the malware author can see "how much" of the halting problem AV software "solves", and then deliberately hide their bad/suspicious actions just out of reach of that limit.
Simple everyday heuristics are good for a lot of things, but the one thing that they are mostly ineffective against is intentional deception.