0

I have a file scanner that checks if a file is infected or not, I want to make some tests, so I want to create some infected .docx or .pdf or .xls files and to see the response of the scanner to those files, my question: how can I create my own infected files without damaging my computer?

I know EICAR but this infected string works only on .txt files

  • are you sure it only works on txt files? – schroeder Feb 8 '18 at 13:27
  • would renaming the txt file into a .docx file work for your tests? – schroeder Feb 8 '18 at 13:27
  • Infected with... what? – Tom K. Feb 8 '18 at 13:32
  • @schroeder If I create a .docx file and copy paste EICAR string it tells me that the file is clean, some demo here – IOException Feb 8 '18 at 13:39
  • what happens if you put it in the metadata or if you rename a txt to a docx? – schroeder Feb 8 '18 at 13:40
2

EICAR should work on any file name or extension. It is intended to be placed into a .COM file in the first place.

For Microsoft Office files, your best bet is to add a bunch of VBA macros in that try to create files with .exe extensions and write junk (perhaps EICAR) into them. For newer (e.g. xlsx, docx) files the format is just a ZIP, so you can also include EICAR into there as an embedded file too.

For PDF files you could use one of the known exploits for PDF readers, but make the payload benign. There's a decent-ish tutorial here on how to generate PDF exploit payloads with Metasploit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.