← All detection heuristics · Extracted artifact
info
EICAR_TEST_ARTIFACT
What it means
An extracted attachment is exactly the standardized inert EICAR antivirus test record.
Why it fires
The attachment remains carved and its antivirus result remains visible, but the exact canonical test record does not represent live malware. Modified records and files containing any additional executable content do not receive this exception.