Underhanded contest (?): Anti-Virus wars
bash (113)

sort -t, "$1"
#PK^C^D^@^@^@^@^@^@^@^@^@^@^@^@^@^@D^@^@^@D^@^@^@^@^@^@^@X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


The above uses caret notation. Notably, ^@ indicates a null byte.

How it works


sort -t, "$1" sorts the file specified as the first command-line argument ($1), using the comma character as field delimiter (-t,).
# at the beginning of the second line comments it out; it will get ignored by bash.
PK^C^D^@^@^@^@^@^@^@^@^@^@^@^@^@^@D^@^@^@D^@^@^@^@^@^@^@ is the shortest possible ZIP file local file header:


PK^C^D (0x04034B50) is the local file header signature.
^@^@^@^@^@^@^@^@^@^@^@^@^@^@ specifies the ZIP version, a bit flag, the compression method and the compressed file's mtime and checksum. All are set to zero.
The twice occurring D^@^@^@ (0x00000044 or 68) specifies the file's compressed and uncompressed length (68 bytes).
^@^@^@^@ specifies the filename and extra header length. Both are set to zero.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* is the 68 byte long  EICAR test string, which serves as the data associated to the above header.


This takes advantage of the fact that ClamAV will act on all ZIP file local file headers, even if they're encountered outside of actual ZIP files.

Malware scan

VirusTotal gives 15 false positives out of its current 51 scanners. This includes ClamAV.