Added Eicar Rule

2575c29e · Marc Rivero López · GitHub · 9d4a82a8 · 2575c29e
Commit 2575c29e authored Apr 12, 2017 by Marc Rivero López Committed by GitHub Apr 12, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 13 additions and 0 deletions

MALW_Eicar malware/MALW_Eicar +13 -0

No files found.
--- a/malware/MALW_Eicar
+++ b/malware/MALW_Eicar
+rule eicar 
+{
+	meta:
+		description = "Rule to detect Eicar pattern"
+		author = "Marc Rivero | @seifreed"
+		hash1 = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
+
+	strings:
+		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
+
+	condition:
+		all of them
+}