Implementing an EICAR like test function

[cyberbix]

Wouldn´t it be great to have an EICAR like test function that allows to test the correct function of MacroMilter easily ?

I.e. Implementing the detection of a simple OLE-Macro: "hello_macromilter" that just writes an EICAR like string. The macro cannot harm if accidentally delivered, is easy to generate in an MS Office application and likely generates (or likely NOT generates) a log entry in MacroMilter.

To not interfere with other malware scanners on a mailserver, it differentiates clearly from EICAR or other signatures that eventually trigger another Malware scanner.

Optionally a custom reject code and message could be implemented, to signal a sending test-system that testmacro has detected and everything on MacroMilter is fine.

[decalage2]

Since MacroMilter uses the MacroRaptor engine to detect if a macro is suspicious or not, you just need a three-lines macro that runs automatically (e.g. AutoOpen) and launches a command, for example shell "calc.exe". For example for Word:

Private Sub Document_Open()
  Shell "calc.exe"
End Sub

AFAIK MacroMilter does not rely on antivirus signatures, so it will not detect EICAR. What you need is a VBA macro that triggers MacroRaptor. More info: https://github.com/decalage2/oletools/wiki/mraptor

[sbidy]

@decalage2 thank you for the fast response and answer!