Safe

eicar_com.zip appears safe. 14 of 76 antivirus engines report it clean, with only 62 low-confidence detections that read as false positives. As a habit, only open files you downloaded from the official source, since attackers sometimes distribute trojanised copies of legitimate software under the same name.

eicar_com.zip is a compressed archive, about 184 bytes. Our analysis found no threat indicators for it. A file's name can be reused by different files, so we identify it by its cryptographic hash (below).

62 of 76 antivirus engines flagged eicar_com.zip, 62 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.

Yes — this exact file is a known, catalogued malware sample in the abuse.ch MalwareBazaar threat-intelligence feed, first seen on July 3, 2024. A confirmed listing there is strong, independent evidence that the file is malicious.

The SHA-256 hash of eicar_com.zip is 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad, and its MD5 is 6ce6f415d8475545be5ba114f208b0ff. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

Based on this scan, yes — eicar_com.zip shows no threat indicators. The important caveat is source: make sure you downloaded it from the official website or a trusted store, because attackers sometimes distribute malware-laced copies under a legitimate file's name. If your own antivirus flags it while we report it clean, that is most often a false positive, but verify the source before overriding your antivirus.

This report reflects the scan run on April 20, 2026. Because a file's hash never changes, the identity of eicar_com.zip is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.