I would imagine this has to due with DAT reputation take a look at the following.
The McAfee DAT Reputation feature will be automatically enabled on May 19, 2015. This applies to customers updating from CommonUpdater who have not yet configured a policy.
For details on how to configure DAT Reputation polices, see PD25481 - DAT Reputation Implementation Guide (https://kc.mcafee.com/corporate/index?page=content&id=PD25481
great hint! We installed the DAT Reputation Extension and disabled DAT reputation. We will check if this changes the Behavior.