Is this JAR Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

The static analysis examined 2 190 classes inside the JAR and was able to parse every one of them. However, 359 classes (≈16 %) triggered decompiler anomalies, mainly “stack underflow” warnings. These warnings usually appear when the bytecode is highly optimized or uses patterns that the decompiler struggles with; they are not automatically a sign of malicious intent.

A subset of the classes belongs to the package shcm.shsupercm.fabric.citresewn.compat…, which is the core of a Fabric‑based Minecraft mod. Those classes show several “hard‑review indicators” such as reflection usage, file‑system access, and outbound‑connection calls (e.g., java.net.URL, java.net.http.HttpClient). No explicit signatures of credential theft, hidden payload download, or system‑level process execution were reported.

The remaining classes are mostly utility helpers (named like b.AccessWidenerHelper, b.BlockModelBaker, etc.) that belong to a large shaded library. Their decompiler failures are also due to complex bytecode rather than suspicious logic.

Questions the Full Report Answers

• Does the JAR try to open network connections? Yes, a few classes contain outbound‑connection indicators, likely for update checks or telemetry.
• Are the suspicious signals coming from the mod’s own code or from bundled libraries? Most decompiler anomalies are in the shaded utility library (b.* classes). The only concerning indicators (reflection, file access, network) are in the mod’s own shcm.shsupercm.fabric.citresewn package.
• Is there any evidence of RAT‑like or credential‑stealing behavior? No high‑signal malicious actions (credential theft, hidden downloads, process execution) were detected.
• How much of the code could be inspected? All 2 190 classes were parsed; none failed to decompile completely, though many required fallback handling.

Malware and Virus Findings

No high‑signal malicious behavior was detected. The scanner did not find code that reads or exfiltrates credentials, writes hidden files, spawns external processes, or performs destructive actions.

RAT Detection

The evidence does not match a remote‑access trojan. While the JAR uses reflection and makes occasional HTTP calls, these are typical for mods that load optional features or check for updates.

Suspicious Classes and Evidence

Core JAR or Mod Code

Class	Severity	Behavior	Evidence
shcm.shsupercm.fabric.citresewn.compat.a.a.c.c.ViewD	Medium	Opens URLs / HTTP connections	outbound_connection_indicators (java_net_url_api, url_connection_api)
shcm.shsupercm.fabric.citresewn.compat.a.a.c.c.ParseX	Medium	Uses HTTP client API	outbound_connection_indicators (java_http_client_api)
shcm.shsupercm.fabric.citresewn.compat.a.a.e.BuffA	Medium	Uses HTTP client API	outbound_connection_indicators (java_http_client_api)
shcm.shsupercm.fabric.citresewn.compat.a.a.c.c.BuildO	Low	Reads/writes files	file_access_indicators (java_io_file_api)
shcm.shsupercm.fabric.citresewn.compat.a.a.c.c.ConfigA	Low	Uses reflection	hard_review_indicators (reflection_api)
shcm.shsupercm.fabric.citresewn.compat.a.a.c.c.DataB	Low	Filesystem enumeration	file_access_indicators (java_io_file_api, java_nio_files_api)

All other shcm… classes only show decompiler fallback warnings (stack underflow) without additional risky indicators.

Bundled Third‑Party Libraries

The massive list of b.* helper classes (e.g., b.AccessWidenerHelper, b.BlockModelBaker, b.SoundEngineHelper, etc.) all triggered decompile_fallback due to stack‑underflow errors. They have an obfuscation_score of 3, but no network, file‑system, or reflection signals. These are typical of a heavily shaded library used for Minecraft’s rendering and data handling.

Network Activity

• Outbound URL connections via java.net.URL and java.net.http.HttpClient in a few shcm… classes.
• No explicit domain names or IP addresses were extracted; the scanner only noted the use of generic URL/HTTP APIs.

Deobfuscation and Analysis Coverage

• Classes parsed: 2 190 (100 %).
• Decompile failures: 0.
• Decompiler anomalies: 359 classes (≈16 %) with stack‑underflow fallbacks.
• Obfuscation signals: Mostly “no_local_variable_table” and “fallback_stack_underflow”. No dense encryption, packing, or anti‑debug tricks were reported.

Is This Minecraft Mod Safe?

Yes, the JAR appears to be a Fabric‑compatible Minecraft mod (package shcm.shsupercm.fabric.citresewn). The majority of the code is a large shaded utility library, and the mod’s own classes only perform typical actions such as optional file access and occasional HTTP calls.

What Looks Normal

• The huge b.* helper package is a common pattern for Minecraft mods that shade large libraries for rendering, world generation, and data handling.
• Use of reflection, file enumeration, and HTTP connections is normal for mods that load optional resources, read configuration files, or check for updates/metrics.
• No signs of malicious payload delivery, credential harvesting, or system‑level process execution.

What Is Dangerous

• The only mildly concerning items are the outbound‑connection calls in a few shcm… classes. They could be used for update checks or telemetry, which is typical but worth noting.
• No high‑severity red flags were found.

What Should You Do?

1. If you trust the source (e.g., the mod is from a reputable mod repository), you can install it.
2. Keep an eye on network traffic the first time the mod runs; ensure it only contacts expected update or metric servers.
3. If you are uneasy about any outbound connections, you can disable internet access for the Minecraft server/client while testing.

Scan Limitations

Static JAR scanning can identify suspicious patterns but cannot guarantee absolute safety. Runtime behavior, dynamic class loading, or external resources fetched after launch are not covered by this analysis.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes, a JAR can embed malicious Java code that runs when the JAR is loaded, but many JARs are perfectly benign.

How do I check whether a JAR file is safe?

Use a static scanner (like the one that produced this report), verify the source, and optionally monitor its runtime behavior (network, file access).

Can this scanner detect a Minecraft RAT?

It can flag typical RAT behaviors (credential theft, hidden downloads, remote command execution). This report found none of those patterns.

Does obfuscation mean a JAR is malicious?

Not necessarily. Obfuscation is often used to protect intellectual property or reduce size. It only raises suspicion when combined with other risky indicators.

Final JAR Safety Verdict

Verdict: Mostly trust
Risk level: Low‑to‑moderate
Confidence: High (full class coverage, no high‑signal malware)

Should I trust this JAR, and why?
The JAR is a Fabric‑based Minecraft mod that mostly consists of a large shaded utility library. All classes were successfully parsed, and no evidence of credential theft, hidden downloads, or system‑level malicious actions was found. The only notable behavior is a few outbound HTTP calls, which are typical for update checks or telemetry in mods. Given the thorough coverage and lack of high‑severity threats, the file can be used with confidence, especially if it comes from a trusted source.