Why not at least link to the virustotal listing for said file? Perhaps someone else has it from the hash?

I doubt the CA would lie about the existence of such a file, although perhaps they are mistaken about the signature (it could be a case of a 570 MB file concatenated with a legitimately signed winrar executable - signatures don't always cover all parts of the file)