It is a test file for malware detection software (in fact, it will still get flagged today if you try to send it, download it or save it to your disk). It prints “EICAR-STANDARD-ANTIVIRUS-TEST-FILE!” when run.
It was purposefully made so all the opcodes appeared as characters you can type on a standard keyboard. That way, anyone can write the file themselves even if they don’t have internet or a way to download it. It’s also easier to get it into test containers/VMs that are isolated from the internet or physical hardware, which is where most malware testing happens.
I’m guessing those emoji happen to encode the opcodes for a program?
Yeah. This method is really cool, and it has been used for legitimate cases before. Look at the EICAR file:
It is a test file for malware detection software (in fact, it will still get flagged today if you try to send it, download it or save it to your disk). It prints “EICAR-STANDARD-ANTIVIRUS-TEST-FILE!” when run.
It was purposefully made so all the opcodes appeared as characters you can type on a standard keyboard. That way, anyone can write the file themselves even if they don’t have internet or a way to download it. It’s also easier to get it into test containers/VMs that are isolated from the internet or physical hardware, which is where most malware testing happens.
Neat.