[!WARNING] Final verdict available at the end of this report.
The scanner inspected all 7 classes in this 74.6 KB JAR and successfully parsed and decompiled every class. It found 3 classes with suspicious API usage: file access, process-launching support, network/socket support, Base64 handling, and archive/package handling. No suspicious files were found hidden inside the JAR archive itself.
The findings are concentrated in a small set of unusually named com.github.* classes rather than clearly identifiable third-party libraries. One class also caused a partial decompiler fallback because the decompiler encountered a stack-underflow issue in one method. The code was still inspected, but this method deserves closer review alongside the file, process, and network-related behavior.
No high-signal malicious behavior was detected.
Specifically, the report contains no direct evidence of credential or token theft, browser-data collection, hidden payload downloads, persistence mechanisms, destructive file deletion, or confirmed data exfiltration. It also contains no embedded URLs, hostnames, or IP addresses that would identify a known command-and-control server or download location.
However, the JAR does contain APIs that can read/write files, create or work with archives, make socket connections, encode/decode Base64 data, and launch processes. Those capabilities are not proof of malware, but their combination needs explanation from the plugin’s source, publisher, or expected features.
The report does not provide enough evidence to identify this JAR as a remote-access trojan (RAT).
There is no confirmed remote command handler, persistence mechanism, known remote-control endpoint, or evidence that commands received over the network are executed locally. Still, the presence of both socket/network APIs and ProcessBuilder process-launching APIs means a deeper review would be appropriate before treating it as fully trusted.
The report does not attribute these classes to common bundled libraries such as bStats, HSQLDB, SLF4J, Apache Commons, or HikariCP. They appear to be part of the JAR’s own small codebase, or at least code without recognizable library attribution.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
com.github.fqH_xLP |
High | File access and process-launching capability | Its main method uses Java file APIs and ProcessBuilder, which can start another operating-system process. It also uses Base64-related APIs. |
com.github.wOKQJu |
Medium | Network/socket communication | Methods use socket APIs and the JAR also references Java URL APIs. No destination host, URL, or IP was found in the report. |
com.github.xdyp_vtox |
High | File/archive handling and process-launching capability | Uses Java file APIs, NIO file APIs, archive-packaging APIs, and ProcessBuilder. Includes methods named runDetached and isQmtx. |
com.github.xdyp_vtox |
Medium | Partially difficult to decompile | One private method triggered a decompiler fallback due to a stack-underflow issue. This can result from unusual bytecode or compiler/decompiler incompatibility; it is not proof of malware by itself. |
The method name runDetached suggests code that may run independently of the main Java process, but the report does not show what it launches or whether it is used for a legitimate helper process. Likewise, an executable main method inside a plugin-sized JAR is noteworthy, although Java libraries and tools can legitimately include one.
No suspicious behavior was attributed by the report to known bundled third-party libraries.
The JAR has only 7 classes and one package, and the scanner did not identify common shaded dependencies that often explain network, database, or file-related detections. This means the flagged behavior cannot be safely dismissed as a routine metrics or database library based on this report alone.
The scanner found use of:
com.github.wOKQJuNo network destinations were identified:
Network API usage can be normal for plugins that contact game APIs, update services, web services, or databases. In this case, the absence of visible destinations makes the intent unresolved rather than automatically malicious.
One method in com.github.xdyp_vtox required a decompiler fallback because of a reported stack-underflow problem while reading bytecode. The scanner gave that method an obfuscation score of 2 based on this fallback issue.
This is a limited anomaly, not evidence of heavy anti-analysis by itself. However, the short, random-looking class and method names reduce readability and make it harder to verify the purpose of sensitive actions such as process execution and detached execution.
A few individual findings can have legitimate uses:
The concern is not any one API alone. It is that this small JAR combines file access, archive handling, network capability, and process launching without clear library attribution or visible network destinations.
The following items remain genuinely concerning or unresolved:
ProcessBuilder.runDetached is associated with file operations, which may indicate an attempt to run something separately from the main application.There is no direct proof in this report that these features are being used maliciously, but they are substantial enough that they should not be ignored.
10020a0a32ab028efa4a9b7b469b2388b5f7ebf607b6ac4b98ae09dc268eb4d5.Static JAR scanning reduces risk by examining code and embedded contents without running the file, but it cannot prove that a JAR is completely safe. Some behavior may only appear at runtime, may depend on configuration or server data, or may be hidden behind code paths that are difficult to interpret.
Likewise, APIs such as ProcessBuilder, sockets, files, and Base64 can be legitimate. The important question is how they are used, which this report cannot fully establish for every method.
Yes. A JAR is Java code and can contain malicious behavior, including data theft, downloads, destructive actions, or remote control logic. It does not need to look like a traditional .exe file to be dangerous.
Check its source and publisher, compare its hash with an official release, inspect permissions and behavior, scan it with a JAR malware scanner, and test unknown files in an isolated environment. A clean scan helps, but no single scan can guarantee safety.
It can identify common RAT-related warning signs, such as remote connections, command execution, persistence, credential access, hidden downloads, and suspiciously difficult-to-review code. In this report, it found network and process-launching capabilities, but no confirmed remote-control or persistence behavior.
No. Developers may obfuscate code to protect intellectual property or reduce copying. However, unclear names and decompiler problems make independent review harder, especially when the same code also accesses files, starts processes, or opens network connections.
Verdict: Use caution
Risk level: Medium
Confidence: Moderate
Should I trust this JAR, and why? Not without verifying its origin and intended features first. The scan found no direct evidence of credential theft, hidden downloads, persistence, destructive behavior, or a confirmed RAT. However, this small JAR contains code capable of accessing files, handling archives, opening network connections, and launching detached operating-system processes, and those behaviors were not attributed to normal bundled libraries. The lack of visible network destinations and the partial decompiler anomaly leave important questions unanswered. Use it only if it comes from a trusted developer and its process-launching behavior is documented and expected.