The GTUBE ("Generic Test for Unsolicited Bulk Email") is a 68-byte test string used to test anti-

spam Spam may refer to: * Spam (food), a canned pork meat product * Spamming, unsolicited or undesired electronic messages ** Email spam, unsolicited, undesired, or illegal email messages ** Messaging spam, spam targeting users of instant messaging ( ...

systems, in particular those based on

SpamAssassin Apache SpamAssassin is a computer program used for anti-spam techniques, e-mail spam filtering. It uses a variety of spam-detection techniques, including Domain Name System, DNS and fuzzy checksum techniques, Bayesian spam filtering, Bayesian filt ...

. In SpamAssassin, it carries an antispam score of 1000 by default, which would be sufficient to trigger any installation. The contents of the string are as follows: XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X and should be placed in the message body of an RFC 5322 compliant

email Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronic ( digital) version of, or counterpart to, mail, at a time when "mail" meant ...

message, without any line breaks or whitespace. Checksums for the string (68 bytes, no trailing newline) are as follows: There exist some varieties, notably the NAItube (which will carry a variable weight) and the GTphish (which will trigger specifically as a

phishing Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...

mail), which are used in the

McAfee McAfee Corp. ( ), formerly known as McAfee Associates, Inc. from 1987 to 1997 and 2004 to 2014, Network Associates Inc. from 1997 to 2004, and Intel Security Group from 2014 to 2017, is an American global computer security software company head ...

implementation of

. The GTUBE is expected to be detected as a substring and is not executable at all, unlike the test for

computer virus A computer virus is a type of computer program that, when executed, replicates itself by modifying other computer programs and inserting its own code. If this replication succeeds, the affected areas are then said to be "infected" with a compu ...

es developed by

EICAR EICAR may refer to: * École Internationale de Création Audiovisuelle et de Réalisation, a film school in Paris * European Institute for Computer Antivirus Research ** EICAR test file The EICAR Anti-Virus Test File or EICAR test file is a co ...

References

Bibliography

* Anti-spam Test items {{malware-stub