• black0ut@pawb.social
      link
      fedilink
      arrow-up
      68
      ·
      13 hours ago

      Yeah. This method is really cool, and it has been used for legitimate cases before. Look at the EICAR file:

      X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
      

      It is a test file for malware detection software (in fact, it will still get flagged today if you try to send it, download it or save it to your disk). It prints “EICAR-STANDARD-ANTIVIRUS-TEST-FILE!” when run.

      It was purposefully made so all the opcodes appeared as characters you can type on a standard keyboard. That way, anyone can write the file themselves even if they don’t have internet or a way to download it. It’s also easier to get it into test containers/VMs that are isolated from the internet or physical hardware, which is where most malware testing happens.