MalwareTips
Verified clean — official build of EICAR test file
MalwareTips staff confirmed this binary is the real, unmodified release.
Threat LensFile scan report

Is eicar_com.zip safe?

Verdict
Safe

EICAR test file was independently reviewed and verified as a legitimate, unmodified file by MalwareTips staff.

EICAR test file was independently reviewed and verified as a legitimate, unmodified file by MalwareTips staff.

Open or extract with normal care

This staff-verified file can be used normally when it came from the expected official source.

Read the full analysis
Saved file evidenceAntivirus consensus
62of 76 flagged
Flagged 62No detection 14
Digital specimeneicar_com.zip2546dcffc5ad854d4d…4ac23b6e9eedad
Size184 B
Code signingNot applicable
SandboxNot run
First seen20y ago
Evidence3 priority signals
MalwareTips staff reviewed this exact hash and classified it as safe.

Recommended next actions

01

Before opening or extracting

Open or extract it only when its sender or download source has been independently verified.

02

If you already opened or extracted it

Keep normal device protection enabled and stop if the file behaves unexpectedly.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

MalwareTips staff review

Staff assessment of this file

The decision below was made by staff for this exact SHA-256 hash.

100%Confidence
Very high
Analyst conclusion

EICAR test file was independently reviewed and verified as a legitimate, unmodified file by MalwareTips staff.

Where this verdict could be wrong1 caveat
  • The staff decision applies to this exact SHA-256 hash; a different build requires a separate review.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Recommended action

This staff-verified file can be used normally when it came from the expected official source.

Scan transparency

Coverage & freshness

1 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

  • Antivirus

    Complete

    62 of 76 engines flagged the file.

  • Sandbox

    Not run

    No runtime observation is recorded for this report.

    No timestamp recorded

  • Network

    Not run

    No contacted-host reputation check is recorded.

    No timestamp recorded

  • YARA

    Not run

    No rule evaluation is recorded for this report.

    No timestamp recorded

  • External intel

    Partial

    3 of 3 independent reference sources completed.

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

This file appears low risk based on the evidence available now.

  1. Recovery step 01

    Open or extract it only when its sender or download source has been independently verified.

  2. Recovery step 02

    A clean result reduces known risk, but it cannot guarantee that every new or targeted threat has been detected.

  3. Recovery step 03

    Keep your antivirus and Windows updates switched on so you stay protected.

Safety FAQ

Direct answers grounded in the saved verdict and evidence in this report.

7 evidence-based answers
Is eicar_com.zip safe?
Evidence-based answer
eicar_com.zip appears safe. 62 of 76 antivirus engines flagged it; the 62 detections were treated as non-decisive after the wider evidence was weighed. Open or extract it only when its sender or download source has been independently verified.
What is eicar_com.zip?
Evidence-based answer
eicar_com.zip is a compressed archive, about 184 bytes. Our analysis did not identify a verdict-driving threat signal. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).
How many antivirus engines detected eicar_com.zip?
Evidence-based answer
62 of 76 antivirus engines flagged eicar_com.zip, 62 of them as outright malicious. The raw count alone does not establish safety or danger; we also weigh which engines flagged it and corroborating behavior, identity, reputation, and rule evidence.
Has eicar_com.zip been seen before?
Evidence-based answer
Yes — this exact file is a known, catalogued malware sample in the abuse.ch MalwareBazaar threat-intelligence feed, first seen on July 3, 2024. A confirmed listing there is strong, independent evidence that the file is malicious.
What is the SHA-256 hash of eicar_com.zip?
Evidence-based answer
The SHA-256 hash of eicar_com.zip is 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad, and its MD5 is 6ce6f415d8475545be5ba114f208b0ff. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
Is it safe to open or extract eicar_com.zip?
Evidence-based answer
Based on the recorded evidence, eicar_com.zip has a low observed risk. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it, verify the source and the exact hash before overriding the warning.
How up to date is this analysis of eicar_com.zip?
Evidence-based answer
This report reflects the scan run on April 20, 2026. Because a file's hash never changes, the identity of eicar_com.zip is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Scanned by
JackStaff
Scan another
Check a different file
URL instead?
Check if a link is safe
The raw file is processed temporarily and is not retained after processing. Its hash and report are public and permanent, so the next person who checks the same file gets an instant answer. Unknown files may be submitted to VirusTotal for analysis. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.