They have created EICAR(European Institute for Computer Antivirus Research) test virus, just for testing antiviruses. This virus does nothing only all antiviruses get triggered if they are working properly.
This is a safe way to test your antivirus.
Open Notepad, and put the following line and try to save it as some executable like "eicar.exe". See what happens.
Personally, I do not recommend what o_rly has said, if VirtualBox is networked with host OS, some malwares have the ability to spread through it. Most antivirus companies use a separate un-networked computer as a testing machine. If they test for a network worm, then they use a separate network as testing machine network.