I was trying to send the eicar.com virus to someone to test an antivirus. When I've tried to send it as is, Google SMTP blocked it, saying that the software was malicious.
So I've zipped it with a simple password (1234) and it blocked it again. I assumed that the server somehow brute forced it because the password was too simple. So I've then tried to use a stronger password (jfdsg4453dsfsf), and it blocked it again.
For testing, I've also tried to send a similar non-virus file in a zipped, password-protected, archive, and it works.
So I'm wondering, how does Google know what contains a virus and what doesn't? Since I've used different passwords, it cannot check the hash or anything. Or is it that zipped archives can be easily brute forced?