[!WARNING]
Final verdict available at the end of this report.
The scanner examined 1 872 classes (all successfully parsed) and identified 133 classes with at least one “suspicious” indicator, which is about 7 % of the total. Most of the flags come from bundled third‑party libraries (HikariCP, PostgreSQL driver, JLayer audio libraries, Tritonus, SLF4J, etc.) that are commonly used in many Java projects and often trigger generic warnings such as file‑access or reflection usage.
In the core part of the mod (the ro.crimson.framework.* packages) the scanner saw a large number of hard‑to‑review indicators (reflection, class‑loader usage) and network activity pointing to several hard‑coded URLs, most notably Discord webhook URLs and a QuickMenuLogService that uploads data to those webhooks. Those signals are not typical for a simple Minecraft client‑side mod and deserve closer inspection.
The report also lists 5 decompiler anomalies (mostly due to very large methods) but no outright decompilation failures.
No high‑signal malicious behavior such as credential theft, hidden payload download, destructive system commands, or persistence mechanisms was detected.
The most notable activity is uploading data to Discord webhooks (see “QuickMenuLogService” and “DiscordStatusConfig”), which constitutes data exfiltration but not classic malware.
The evidence does not match a Remote Access Trojan (RAT). There is no code that opens a back‑door shell, executes arbitrary commands from a remote server, or maintains persistent remote control.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
ro.crimson.framework.service.QuickMenuLogService |
High | Sends detailed user actions (UUID, IP, page, action, etc.) to a Discord webhook | network_http_upload_combo, outbound URL https://discord.com/api/webhooks/... |
ro.crimson.framework.service.DiscordStatusService |
Medium | Reads/writes a saved message ID, may post status updates to Discord | File‑access, outbound webhook URL |
ro.crimson.framework.config.GeneralConfig |
High | Loads a Discord webhook URL from config and can post to it | Hard‑coded external URL, file‑access |
ro.crimson.framework.service.ScreenshotService |
Medium | Uploads screenshot bytes to a Discord webhook | Outbound URL, network upload |
ro.crimson.framework.service.RealWeatherService |
Low | Calls public weather APIs (open‑weather, open‑meteo) – normal telemetry | Hard‑coded external URLs |
ro.crimson.framework.client.DiscordRpcClient |
Low | Connects to Discord RPC endpoint | Hard‑coded external URL |
ro.crimson.framework.service.BannedCraftService, ...BarrierBiomeService, ...JobGarageService |
Low | Reads/writes local config files | File‑access indicators |
Many other ro.crimson.framework.* classes |
Low‑Medium | Use reflection and class‑loader APIs (common for mod integration) | Hard‑to‑review code indicator |
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
com.zaxxer.hikari.* |
Low | Database connection pooling, uses reflection & class‑loader | Hard‑to‑review, file‑access |
org.postgresql.* |
Low | PostgreSQL driver, performs socket connections to DB servers | Outbound connection, crypto, file‑access |
javazoom.jl.* |
Low | MP3 decoding and playback, accesses files and URLs for audio streams | File‑access, outbound URLs |
org.tritonus.* |
Low | Audio system utilities, file‑access and URL fetching | File‑access, outbound URLs |
org.slf4j.*, org.apache.* |
Low | Logging and XML utilities, contain hard‑coded URLs for schemas | Hard‑coded external URLs |
junit.* |
Low | Test framework classes, flagged for reflection & class‑loader usage | Hard‑to‑review |
https://discord.gg/Kx2VzVmttP. https://api.open-meteo.com/..., https://api.openweathermap.org/.... http://www.server.com/remotefile.mp3, http://www.shoutcastserver.com:8000. http://jdbc.postgresql.org/....The JAR is a Minecraft client‑side framework/mod (packages under ro.crimson.framework). It adds features such as custom UI, Discord integration, weather fetching, and database support. The presence of Discord webhooks for logging user actions and screenshots is unusual for a typical client mod and could be considered invasive.
Static analysis can reveal suspicious patterns but cannot prove that the JAR will never perform malicious actions at runtime. Dynamic behavior (e.g., conditional code paths, user‑triggered actions) may not be fully captured. Always combine static results with runtime monitoring if you need higher assurance.
Yes. A JAR can embed malicious Java bytecode that runs when the JAR is loaded, but many “virus‑like” flags are also triggered by legitimate libraries.
Use a reputable static scanner (like the one that produced this report), review the flagged classes, especially any outbound connections, and consider running the JAR in a sandbox or monitoring its network activity.
It can spot typical RAT behaviors (remote command execution, hidden downloads, persistence). This JAR does not exhibit classic RAT traits, but it does exfiltrate data via Discord webhooks.
Not necessarily. Obfuscation can be used to protect intellectual property or to hide malicious intent. In this case, only a few large methods triggered complexity guards; there is no strong evidence of deliberate malicious obfuscation.
Verdict: Use caution
Risk level: Medium
Confidence: High (based on comprehensive static analysis)
Should I trust this JAR, and why?
The JAR is largely composed of standard libraries and typical Minecraft‑mod code, and it does not contain classic malware such as credential stealers or back‑doors. However, it deliberately sends detailed user data—including IP addresses, UUIDs, and screenshots—to publicly accessible Discord webhooks. That behavior poses a privacy risk and could be abused. If you are comfortable with that level of telemetry, you may keep the mod, but you should be aware of the data it transmits and consider disabling or removing the Discord‑related features.