id: eicar-malware

info:
  name: Eicar Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Eicar.yar
  tags: malware,file
file:
  - extensions:
      - all
    matchers:
      - type: word
        part: raw
        words:
          - "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"
# digest: 4a0a00473045022100fac170412dc4d6b6d786ed0677b2b05d729c738d5a1241c1e0d32d5f2f4abf9e02205887c9624d10bed150b7ce8b6b4d1b94806a38c007ac25b49e29abc1f8029e3d:922c64590222798bb761d5b6d8e72950