Is Copy_of_Fapcraft_1.12.2_v1.1.jar Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

This scan examined a 45.8 MB Java JAR containing 1,843 classes and 19,717 methods. Every class was successfully parsed and decompiled, with no unreadable classes and no suspicious files hidden as archive entries. The scanner marked 181 classes (about 9.8%) for review because they use files, networking, reflection, class loading, or other APIs that can be used for either normal features or abuse.

Most of the flagged classes belong to bundled libraries, especially Apache Commons Lang, Jackson JSON tools, and GeckoLib. These libraries commonly use reflection, file handling, ZIP/resource-pack scanning, and class loading as part of their normal functionality. The mod’s own code also contains file access, a Mojang profile lookup, an external Fapcraft tutorial-video URL, and one generic socket API indicator.

The decompiler reported fallback/stack-analysis anomalies in 38 classes (about 2.1% of the JAR). These are concentrated in the mod’s short-named com.trolmastercard.sexmod classes, including animation, rendering, entity, GUI, and networking-related methods. The report provides enough context to distinguish ordinary bundled-library alerts from the smaller set of core-code items worth closer inspection.

Questions the Full Report Answers

Malware and Virus Findings

No high-signal malicious behavior was detected.

The report does not identify credential or token theft, browser-data collection, clipboard theft, hidden payload downloads, operating-system command execution, ransomware-like file modification, persistence mechanisms, or clear data exfiltration. It also found no suspicious archive entries, and all classes were parsed successfully.

The JAR does use file APIs, networking APIs, Base64-related APIs, reflection, and class loaders. Those capabilities require context, but this report does not show them being combined into an obvious malware chain.

RAT Detection

The evidence is not consistent with a clear remote-access trojan (RAT). There is no reported remote command execution, shell/process launching, hidden control server, persistence, credential collection, or obvious command-and-control behavior.

One core class, com.trolmastercard.sexmod.x$a, uses Java socket APIs without an identified host or URL in the report. Socket support alone is not proof of remote control—it can be used for ordinary game or mod networking—but its exact purpose is not established by this static scan.

Suspicious Classes and Evidence

Core JAR or Mod Code

Class Severity Behavior Evidence
com.trolmastercard.sexmod.Main Low Reads or writes configuration/files setConfigs() uses Java file APIs; normal for a mod configuration system
com.trolmastercard.sexmod.a Moderate References an external tutorial video and uses files/reflection Hard-coded http://fapcraft.org/assets/video/tutorial/girl_wand.mp4; likely a tutorial/media feature, but it uses plain HTTP and the class has decompiler anomalies
com.trolmastercard.sexmod.f0 Low Connects to Mojang’s profile service https://sessionserver.mojang.com/session/minecraft/profile/; likely retrieves a Minecraft player profile/skin-related resource
com.trolmastercard.sexmod.y Low Connects to Mojang’s profile service Same official Mojang profile endpoint; method returns a BufferedImage, consistent with downloading a player image/skin
com.trolmastercard.sexmod.x$a Moderate Uses socket networking Generic socket API detected, but no destination or purpose was identified in this report
com.trolmastercard.sexmod.br and related classes Low File handling Several file API calls; the report does not show destructive file behavior
com.trolmastercard.sexmod.e3, eb, em, f_, fl Low Java NIO file/path access File and path operations in entity, animation, or world-related classes; no theft or deletion behavior reported
Several short-named mod classes Moderate Decompiler fallback/stack-analysis issues 38 classes have stack-underflow fallback warnings and stripped local-variable information; code was still parsed and decompiled

The short class and method names—such as a, e3, and f_—make the mod harder to review. However, Minecraft 1.12.2 mods often contain names affected by Minecraft’s own mappings, build process, or stripped debugging metadata. Short names alone do not establish malicious obfuscation.

Bundled Third-Party Libraries

Class or Library Severity Behavior Evidence
Apache Commons Lang (org.apache.commons.lang3.*) Low Reflection and class-loader helper functions Standard utility library APIs, including annotation handling, serialization helpers, and reflection utilities
GeckoLib (software.bernie.geckolib3.*) Low Resource-pack, folder, and ZIP-file scanning GeckoLibCache enumerates resource-pack files and ZIP contents; expected for loading model/animation resources
Shadowed Jackson (software.bernie.shadowed.fasterxml.jackson.*) Low JSON parsing, serialization, file/URL support, reflection Standard JSON library functionality; generic URL/file methods are library capabilities, not evidence that the mod calls every one
Jackson DOM support Informational Contains an XML standards URL string http://javax.xml.XMLConstants/feature/secure-processing is an XML feature identifier, not a normal external service endpoint

Of the 181 flagged classes, the large majority are from these bundled libraries. In particular, the 155 “hard to review” alerts are mostly reflection or class-loading functions inside Apache Commons and Jackson. These are expected capabilities for general-purpose Java libraries and should not be treated as separate malware findings.

Network Activity

The report identifies these explicit network-related strings and APIs:

Deobfuscation and Analysis Coverage

The scanner successfully processed the entire JAR. The 38 anomalies are fallback messages such as “stack underflow” while reconstructing certain methods. This means the decompiler had difficulty producing clean high-level source for parts of those methods; it does not mean the class could not be read at all.

Several affected classes use very short names and have no local-variable debug information. That makes manual review more difficult and may indicate a release build with stripped symbols or obfuscation. The anomalies appear in rendering, animation, entity, GUI, and event-handler methods, rather than in a clearly identified downloader, command runner, or credential-stealing component.

Is This Minecraft Mod Safe?

This appears to be a Minecraft 1.12.2 Forge mod: it includes Minecraft classes and events, GeckoLib, player/entity rendering methods, resource-pack handling, and calls to Mojang’s official profile service.

Its core behavior is broadly consistent with a content-heavy Minecraft mod: configuration files, custom entities, animations, resource loading, player-profile image lookups, and a tutorial media reference. However, the file name begins with Copy_of_, which does not establish where the JAR came from or whether it matches an official release. The scan can assess code indicators, but it cannot verify publisher identity or distribution history.

What Looks Normal

What Is Dangerous

No major malware red flags were found, but these items remain unresolved:

What Should You Do?

Scan Limitations

Static JAR scanning reduces risk by examining code structure, APIs, embedded URLs, and library contents, but it cannot prove a file is completely safe. It cannot confirm what a remote server will return later, prove a particular code path is never triggered, or establish that a downloaded JAR genuinely came from its claimed author. Runtime monitoring and verifying the source remain important.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A Java JAR can contain malicious code, including code that steals data, downloads payloads, modifies files, or connects to remote servers. This report found no high-signal evidence of those behaviors in this JAR.

How do I check whether a JAR file is safe?

Use a JAR malware scanner, review its network and file-access behavior, check whether flagged code is from known libraries, and verify that the download came from the original developer. For this JAR, confirming the source and investigating the unresolved socket use would add confidence.

Can this scanner detect a Minecraft RAT?

It can identify common RAT-related clues, such as hidden network connections, command execution, persistence, credential theft, payload downloading, and heavily concealed code. This scan did not find those high-signal RAT behaviors, though it cannot guarantee that no malicious behavior is possible.

Does obfuscation mean a JAR is malicious?

No. Obfuscation or short class names can be used for intellectual-property protection, build optimization, or because Minecraft mod mappings remove meaningful names. It becomes more concerning when paired with hidden downloads, credential theft, remote commands, or widespread anti-analysis behavior; those combinations were not identified here.

Final JAR Safety Verdict

Verdict: Use caution
Risk level: Moderate
Confidence: Moderate

Should I trust this JAR, and why? The scan does not show clear virus, RAT, credential-stealing, destructive, persistence, hidden-download, or remote-command behavior. Most alerts come from normal bundled libraries such as GeckoLib, Apache Commons, and Jackson, while the identified Mojang connection is expected for a Minecraft mod. However, the mod’s own code contains unresolved generic socket use, a plain-HTTP external media reference, and 38 classes with decompiler anomalies and difficult-to-read names. Use it only if you can verify that this exact hash came from a trusted official source; otherwise, test it in an isolated Minecraft profile first.