The problem with the droppers is that they vary by the day - or even hour. It is when they unpack that Avast gets a handle on the main files