Is _1.8.9__BetterKeystrokes_V-1.2.jar Safe? JAR Virus and Malware Scan Report

[!WARNING]
Final verdict available at the end of this report.

What This JAR Scanner Found

The scanner examined 517 classes (all successfully decompiled) and identified 136 suspicious classes (≈ 26 % of the total). Most of the “suspicious” flags come from well‑known third‑party libraries such as JNA (used for Discord Rich Presence) and Apache Commons IO (a general‑purpose file‑utility library).

The analysis also detected a sizable amount of network‑related indicators – the jar contains hard‑coded URLs to GitHub, Discord, the Hypixel and Mojang APIs, a launch‑tracking service, and a raw‑GitHub file that holds version information. File‑access and reflection APIs are present because the mod reads and writes configuration files and loads native libraries.

While the sheer number of flags can look alarming, many of them are normal for a Minecraft client mod that:

checks for updates,
reports usage statistics,
talks to game‑related APIs (Hypixel, Mojang),
integrates Discord Rich Presence, and
manipulates local config files.

No clear evidence of credential theft, hidden payload download, or destructive system changes was found.

Questions the Full Report Answers

Does the jar make outbound connections? Yes, to several well‑known sites (GitHub, Discord, launchtracker.raventeam.repl.co, Hypixel, Mojang, Paste EE, raw GitHub).
Are the risky behaviors in the core mod code or in bundled libraries? Both, but the core code only performs expected actions (config I/O, API calls). The more “dangerous‑looking” calls (native loading, reflection, process exec) belong mainly to bundled libraries (JNA, Apache Commons IO).
Is there any RAT‑like functionality (remote command execution, persistence, data exfiltration)? No.
How complete was the static analysis? 100 % of classes were parsed and decompiled; no decompiler anomalies were reported.

Malware and Virus Findings

No high‑signal malicious behavior was detected.
The only potentially concerning indicators are:

Use of Runtime.exec in org.apache.commons.io.FileSystemUtils (checks free disk space).
Native library loading via JNA (required for Discord RPC).

Both are typical for legitimate functionality and do not upload or steal data.

RAT Detection

The evidence does not match any remote‑access trojan patterns. There are no persistent background services, no command‑execution hooks that accept remote input, and no hidden download mechanisms beyond the explicit update URL.

Suspicious Classes and Evidence

Core JAR or Mod Code

Class	Severity	Behavior	Evidence
`keystrokesmod.client.command.commands.Discord`	Low	Opens a Discord invite link when the command runs.	Hard‑coded URL `https://discord.gg/QQMQfCRyNP`.
`keystrokesmod.client.command.commands.Update`	Low	Downloads the latest jar from GitHub.	URLs to GitHub repo and raw jar.
`keystrokesmod.client.main.LaunchTracker`	Low	Sends a simple HTTP GET to a launch‑tracking endpoint.	URLs `https://launchtracker.raventeam.repl.co/...`.
`keystrokesmod.client.module.modules.minigames.BedwarsOverlay`	Low	Queries the Hypixel player API for stats.	URL pattern `https://api.hypixel.net/player?key=`.
`keystrokesmod.client.module.modules.minigames.DuelsStats`	Low	Queries Mojang API for a player’s UUID.	URL pattern `https://api.mojang.com/users/profiles/minecraft/%s`.
`keystrokesmod.client.utils.Utils$Profiles`	Low	Retrieves Hypixel and Mojang data for the player.	Same API URLs as above.
`keystrokesmod.client.utils.version.VersionManager`	Low	Downloads a version file from raw GitHub.	URLs to `raw.githubusercontent.com`.
`keystrokesmod.client.config.Config*`	Low	Reads/writes configuration files on disk.	`java.io.File` API usage.

Bundled Third‑Party Libraries

Class	Severity	Behavior	Evidence
`com.sun.jna.*` (several)	Medium	Loads native DLL/SO for Discord RPC, uses reflection and class‑loader tricks.	`native_load_api`, `reflection_api`, file‑access to extract native libs.
`org.apache.commons.io.*` (DirectoryWalker, FileUtils, FileSystemUtils, etc.)	Low‑Medium	Provides file utilities, may call `Runtime.exec` to query free space.	`process_execution_api`, `file_access_api`, outbound URL support for `copyURLToFile`.
`net.arikia.dev.drpc.DiscordRPC`	Low‑Medium	Wraps Discord Rich Presence native library.	Native loading, file‑access to extract DLL.
`org.apache.commons.io.input.XmlStreamReader`	Low	Can read XML from a URL; used by libraries for convenience.	`url_connection_api`.

Network Activity

Destination	Reason
`https://jitpack.io`	Maven repository for JNA / Discord‑RPC artifacts (found in bundled POM files).
`https://github.com/Kopamed/Raven-bPLUS`	Source repository of the mod (update check).
`https://github.com/Kopamed/Raven-bPLUS/raw/main/build/libs/[1.8.9] BetterKeystrokes V-1.2.jar`	Direct download of the latest jar (update).
`https://discord.gg/QQMQfCRyNP`	Discord invite displayed by the `/discord` command.
`https://launchtracker.raventeam.repl.co/paths` & `https://launchtracker.raventeam.repl.co`	Simple analytics/launch‑tracking ping.
`https://api.hypixel.net/player?key=`	Retrieves Hypixel player stats (used by Bedwars overlay).
`https://api.mojang.com/users/profiles/minecraft/%s`	Retrieves player UUID from Mojang.
`https://api.paste.ee/v1/pastes/`	Helper for creating pastes (used by a utility class).
`https://raw.githubusercontent.com/Kopamed/Raven-bPLUS/main/src/main/resources/assets/keystrokes/version` & `…/branch`	Checks the latest version text file on GitHub.

All outbound connections are simple HTTP GET/POST requests to public endpoints; none attempt to upload local files or execute remote code.

Deobfuscation and Analysis Coverage

Classes parsed: 517 / 517 (100 %).
Decompile attempts: 517 successful, 0 failures.
Decompiler anomalies: None reported.
Obfuscation indicators: None detected; the code is readable and shows typical library package names.

Is This Minecraft Mod Safe?

Yes, the artifact is a client‑side Minecraft mod (Better Keystrokes) that visualises player input and offers a few convenience features (Discord RPC, stats overlays, update checking). Its behavior matches what the author advertises.

What Looks Normal

Update & version checking – contacting GitHub for the latest jar and version file.
Discord Rich Presence – native library loading via JNA is required for this feature.
API calls to Mojang and Hypixel – standard for fetching player UUIDs or stats.
Configuration file handling – reading/writing settings in the client’s config folder.
Launch‑tracking ping – a lightweight analytics call many mods include.
Use of Apache Commons IO – a common utility library that includes many file‑system helpers; its Runtime.exec call is only for free‑space detection on Windows.

What Is Dangerous

Native library loading (JNA) – executes platform‑specific code but is limited to the Discord RPC DLL, which is publicly documented.
Runtime.exec in FileSystemUtils – runs a small system command to query free disk space on Windows; it does not run arbitrary commands supplied by the user.
Outbound connections – the mod contacts several external services. If a user is uncomfortable with any of these, they can disable the related features (e.g., Discord RPC, launch tracker) in the mod’s config.

No evidence of hidden downloads, credential harvesting, or remote command execution was found.

What Should You Do?

Download the jar from a trusted source (e.g., the official mod page or the author’s GitHub).
Review the config files after first launch; you can disable network features you don’t want (Discord RPC, launch tracker).
Keep the mod up‑to‑date – the built‑in update command will fetch the latest version from the same GitHub URL the scanner saw.
If you prefer no outbound traffic, edit the config to turn off the LaunchTracker and Discord modules; the rest of the mod works offline.

Scan Limitations

Static scanning can see which APIs a jar could use, but it cannot guarantee how those APIs behave at runtime. The scanner also cannot detect malicious intent hidden behind legitimate‑looking code paths, nor can it see what data (if any) the mod actually sends to the listed endpoints. Running the mod in an isolated environment or reviewing its source (if available) gives additional confidence.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A JAR can hold Java bytecode that executes malicious actions (e.g., stealing files, downloading other payloads, running system commands). However, most JARs are harmless libraries or applications.

How do I check whether a JAR file is safe?

Use a reputable static scanner (like the one that produced this report), verify the source, inspect the code or decompiled classes if you’re comfortable, and monitor network activity when the jar runs.

Can this scanner detect a Minecraft RAT?

The scanner flags known malicious patterns (process execution, hidden downloads, credential access, etc.). It can highlight suspicious behavior, but it may miss highly targeted or heavily obfuscated RATs that disguise their actions.

Does obfuscation mean a JAR is malicious?

Not necessarily. Some developers obfuscate code to protect intellectual property. However, heavy obfuscation can also be used to hide malicious intent. This jar showed no obfuscation.

Final JAR Safety Verdict

Verdict: Mostly trust
Risk level: Low‑Medium
Confidence: High (full coverage, no decompiler errors, no high‑signal malware indicators)

Should I trust this JAR, and why?
The BetterKeystrokes mod primarily provides on‑screen key visualisation and includes optional features such as Discord Rich Presence, update checks, and API‑based stat overlays. All network calls are to public services that the mod’s documentation mentions, and the native code it loads is the official Discord RPC library. No evidence of credential theft, hidden payloads, or remote control was found. Because the risky‑looking behavior stems from well‑known libraries and expected mod functionality, the jar can be used safely—provided you obtain it from a trustworthy source and are comfortable with its outbound connections (which can be disabled in the config if desired).