EicarSpam Wiki

Antivirus tests using 300 eicar strings.

Brought to you by: mauricelambert

Scripts

EicarSpam Scripts

Cross-platform scripts to test your antivirus software with multiple Eicar files, and different ways to use it.

Scripts are available on my Github
Scripts are available on SourceForge files

1) Web
- HTML (javascript)
2) Windows (without any installation)
- Batch script: Windows XP - Windows 11/2022
- VBScript script: Windows XP - Windows 11/2022
- JScript script: Windows XP - Windows 11/2022
- Powershell script: Windows 7 - Windows11/2022
3) Linux (without any installation)
- Bash
4) Linux (probably no installation)
- Perl
- Python
5) Others
- Ruby
- Nodejs
- PHP

All these scripts work on Windows 10, Debian sid and CentOS 7, some requirements might be required.

Python

Usages

python3 EicarSpam.py

Sources

for a in range(300):
    with open(f"test{a}","w") as f:
        _ = f.write("X5O!P%@AP[4\\PZX54(P^)7CC)7}$_!$H+H*".replace("_", "EICAR-STANDARD-ANTIVIRUS-TEST-FILE"))

Link

SourceForge

Powershell

Usages

powershell ./EicarSpam.ps1

Sources

$string = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$_!$H+H*'.replace('_', 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE')

for($i = 0; $i -lt 300; $i++){
    Set-Content "test$i.txt" $string
}

Link

SourceForge

Bash

Usages

bash EicarSpam.sh

Sources

a='X5O!P%@AP[4\PZX54(P^)7CC)7}$_!$H+H*'
for i in {0..300}; do
    echo "${a/_/EICAR-STANDARD-ANTIVIRUS-TEST-FILE}" > "test${i}.txt"
done

echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$'"EICAR-STANDARD-ANTIVIRUS-TEST-FILE"'!$H+H*' > "test.txt"

Link

SourceForge

VBScript

Usages

cscript EicarSpam.vbs

Sources

part1 = "X5O!P%@AP[4\PZX54(P^)7CC)7}$"
part3 = "!$H+H*"

For i = 1 To 300
    Set FSO = CreateObject("Scripting.FileSystemObject")
    Set file = FSO.CreateTextFile("test" & CStr(i) & ".text", True)
    file.WriteLine(part1 & "EICAR-STANDARD-ANTIVIRUS-TEST-FILE" & part3)
    file.Close
Next

Link

SourceForge

JScript

Usages

cscript EicarSpam.js

Sources

var part1;
var part3;
var file;
var FSO;
var i;

part1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$";
part3 = "!$H+H*";

for (i = 0; i < 300; i++) {
    FSO = new ActiveXObject("Scripting.FileSystemObject");
    file = FSO.CreateTextFile("test" + i.toString() + ".text", true);
    file.WriteLine(part1 + "EICAR-STANDARD-ANTIVIRUS-TEST-FILE" + part3);
    file.Close()
}

Link

SourceForge

Batch

Usages

EicarSpam.bat

Sources

@echo off
SET a=X5O!P%@AP[4\PZX54(P^)7CC)7}$
SET c=!$H+H*
SET b=EICAR-STANDARD-ANTIVIRUS-TEST-FILE

for /L %D in (1,1,300) do echo %a%%b%%c% > test%D.txt

Link

SourceForge

Ruby

Usages

ruby EicarSpam.rb

Sources

300.times {
    |i| File.open("tmp#{i}.txt", 'w') do |f|
        f.write('X5O!P%@AP[4\PZX54(P^)7CC)7}$')
        f.write('EICAR-STANDARD-ANTIVIRUS-TEST-FILE')
        f.write('!$H+H*')
    end
}

Link

SourceForge

Perl

Usages

perl EicarSpam.pl

Sources

foreach my $i ((1..300)) {
    # open a filehandle for your file
    open my $file, '>', "test$i.txt" or die "test$i.txt: $!";
    printf $file '%sEICAR-STANDARD-ANTIVIRUS-TEST-FILE%s', 'X5O!P%@AP[4\PZX54(P^)7CC)7}$', '!$H+H*';
    close $file;
}

Link

SourceForge

PHP

Usages

php EicarSpam.php

Sources

<?php

$middle_string = "EICAR-STANDARD-ANTIVIRUS-TEST-FILE";

for ($i = 0; $i < 300; $i++) {
  $file = fopen("file{$i}.txt", "w");
  fwrite($file, 'X5O!P%@AP[4\\PZX54(P^)7CC)7}$' . $middle_string  . '!$H+H*');
  fclose($file);
}
?>

Link

SourceForge

NodeJS

Usages

node EicarSpam.node.js

Sources

const fs = require('fs');

let middle_string = String.fromCharCode(69,73,67,65,82,45,83,84,65,78,68,65,82,68,45,65,78,84,73,86,73,82,85,83,45,84,69,83,84,45,70,73,76,69);
let middle_string2 = "\133\064\134\120\132\130\065\064";

for (let i = 0; i < 300; i++) {
  fs.writeFile(`file${i}.txt`, '\u{0058}\u{0035}\u{004f}\u{0021}\u{0050}\u{0025}\u{0040}\u{0041}\u{0050}\u{005f}\u{0028}\u{0050}\u{005e}\u{0029}\u{0037}\u{0043}\u{0043}\u{0029}\u{0037}\u{007d}\u{0024}'.replace('_', middle_string2) + middle_string  + atob('ISRIK0gq'), (err) => {if (err) {console.log(err);}});
}

Link

SourceForge

HTML

Usages

start EicarSpam.html   # Windows
open EicarSpam.html    # Linux

Sources

<!DOCTYPE html>
<html>
  <head>
    <title>Eicar Spam</title>
  </head>
  <body>
    <h1>Eicar Spam using javascript into WebPage</h1>
    <script>
const middle_string = 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE';
const url = URL.createObjectURL(new Blob(['X5O!P%@AP[4\\PZX54(P^)7CC)7}$' + middle_string  + '!$H+H*'], { type: 'text/plain' }));
for (let i = 0; i < 300; i++) {
  const link = document.createElement('a');
  link.href = url;
  link.download = `file${i}.txt`;
  document.body.appendChild(link);
  link.click();
  document.body.removeChild(link);
}
    </script>
  </body>
</html>

Link

SourceForge