Threatless

Test with EICAR

What the EICAR test file is, why it exists, and how to use it safely with Threatless.

The EICAR test file is a harmless ASCII sample published by the European Institute for Computer Antivirus Research. Antivirus engines, including ClamAV, treat it as a test signature so you can prove a scanner works without handling real malware.

Never paste the EICAR payload into source control, chat, tickets, or these docs. Some mail filters, Git hosts, and endpoint agents will flag the literal string as malware even though it is inert. Obtain the file only from eicar.org.

What it is

  • A short, documented test file — not a virus, not executable malware
  • Designed so desktop AV, gateways, and engines like ClamAV can share one expected positive
  • Distributed by eicar.org as several download formats (plain test file, zip, and others)

The payload itself is an ASCII line that includes the words EICAR-STANDARD-ANTIVIRUS-TEST-FILE. A non-functional illustration of the shape is:

[official prefix omitted]…EICAR-STANDARD-ANTIVIRUS-TEST-FILE…[official suffix omitted]

That snippet is intentionally incomplete. Do not try to “finish” it from memory in your repository. Download the official file when you need a real positive.

Why it exists

Production malware samples are dangerous to store, email, or commit. EICAR exists so:

  • CI can assert that the scanner still returns infected: true
  • New API keys can be verified end-to-end
  • Security review can see a known-good positive without a malware zoo

A clean scan of a README only proves the happy path. EICAR proves the detection path.

How to use it with Threatless

  1. Download the official test file from eicar.org onto a machine where you are allowed to store AV test files.
  2. Do not commit it. Add it to .gitignore if it lands in a working tree.
  3. Scan it with your API key:
terminal
curl -X POST https://api.trythreatless.com/api/v1/scans \
  -H "X-API-KEY: YOUR_API_KEY" \
  -F "file=@./eicar.com"

Replace eicar.com with whatever filename eicar.org served. Some browsers save it under another name; the content matters, not the extension.

Expected result

A successful detection looks like this (filename and size will match what you uploaded):

200 EICAR
{
  "filename": "eicar.com",
  "extension": "com",
  "sizeInBytes": 68,
  "scanDurationMillis": 18,
  "infected": true,
  "virusName": "Win.Test.EICAR_HDB-1"
}

Notes:

  • infected must be true.
  • virusName is the ClamAV signature string. Win.Test.EICAR_HDB-1 is the usual name; ClamAV may report a closely related EICAR signature if signatures change.
  • HTTP status is still 200. Infection is a successful scan, not an error.
  • The request still consumes one hourly quota unit.

If you receive infected: false, you did not upload the official file (truncated copy, HTML download page, or a zip you did not intend to scan as-is). Download again from eicar.org. If a zip is scanned as a container, ClamAV may still report EICAR inside it — inspect virusName.

What not to do

  • Do not email the payload to contact@trythreatless.com
  • Do not put the full string in GitHub issues or pull requests
  • Do not fetch random “eicar” mirrors; use eicar.org
  • Do not treat a missed EICAR detection as a reason to send real malware to the hosted API

Clean control

Scan any small non-malicious file (for example a text file you created) and expect:

200 clean
{
  "filename": "readme.txt",
  "extension": "txt",
  "sizeInBytes": 12,
  "scanDurationMillis": 15,
  "infected": false,
  "virusName": null
}

Together, a clean file and EICAR cover both verdicts.

Copy a client from Language examples and point it at the file you downloaded from eicar.org.
Previous

Scanning

How Threatless scans files and URLs with ClamAV.

Next