Is dupersunited-1.0.3_1.21.11.jar Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

This scan inspected all 228 classes in dupersunited-1.0.3_1.21.11.jar. Every class parsed successfully, and decompilation was attempted for all classes with no complete decompilation failures. The scanner identified 22 classes with generic security-relevant indicators: mainly file access, network connections, hard-coded URLs, and reflection.

The JAR appears to be a Fabric Minecraft mod. Its detected functionality includes configuration saving/loading, cosmetics, account/session features, proxy-related settings, a server connection over HTTPS and WebSockets, Minecraft profile requests, and downloads of Hall of Fame/Shame data from GitHub. These activities can be legitimate mod features, but networked authentication and account-related code deserve closer inspection.

Three classes produced partial decompiler fallback warnings, including cosmetic and menu-related code. The report also found reflection usage in compatibility/configuration-related classes. Those findings need context: they are not automatically evidence of hidden or malicious code.

Questions the Full Report Answers

• Does the mod contact only identified servers, or are there unexplained outbound destinations?
• Are the network features connected to normal Minecraft profile, cosmetic, or community functions?
• Does the account-related code show evidence of stealing credentials or tokens?
• Are the suspicious findings in the mod’s own code or in bundled third-party libraries?
• How much of the JAR was successfully parsed and reviewed?

Malware and Virus Findings

No high-signal malicious behavior was detected.

The report does not show evidence of hidden payload downloads, operating-system process execution, destructive file deletion, persistence mechanisms, credential exfiltration, token grabbing, or remote-command execution. It does identify account/session-related functionality and file-path handling for launchers, but the supplied evidence does not show credentials or tokens being sent to an untrusted server.

The mod does make outbound connections to its own dupersunited-server.dupers.wtf service, GitHub-hosted JSON files, Sketchfab links, and official api.minecraftservices.com endpoints. Network use itself is not malware; the important question is what data is sent. The static report does not establish harmful data transfer.

RAT Detection

The evidence is not consistent with a remote-access trojan (RAT).

The scan found WebSocket support for the mod’s own server and normal network APIs, but it did not identify command execution, shell/process launching, persistence, hidden remote-control code, or other typical RAT behavior. A WebSocket is a persistent connection used by many legitimate applications; it is worth reviewing because it can exchange messages, but the report does not show it being used to control the computer.

Suspicious Classes and Evidence

Core JAR or Mod Code

All reported class-level findings are in the mod’s own wtf.dupers.dupersunited package rather than clearly identified bundled third-party libraries.

Class	Severity	Behavior	Evidence
features.auth.AuthManager	Moderate	Connects to the mod’s backend by HTTPS and public WebSocket	https://dupersunited-server.dupers.wtf; wss://dupersunited-server.dupers.wtf/ws/public; socket connect/message methods
features.ConfigManager	Moderate	Stores configuration and includes a private WebSocket endpoint	File APIs; https://dupersunited-server.dupers.wtf; wss://dupersunited-server.dupers.wtf/ws/private
features.ssidLogin.SessionAPI	Moderate	Uses Minecraft profile APIs for profile lookup, skin, and name changes	Official api.minecraftservices.com profile endpoints; methods accept a token parameter
features.ssidLogin.AccountsScreen	Moderate	Resolves launcher-related file paths	resolvePath(String os, String launcherName) uses Java file APIs
features.proxies.AccountProxyLinks / ProxyConfigManager	Low–Moderate	Reads or writes proxy/account-proxy settings	Java NIO file APIs
features.AsyncConfigs, ConfigManager, ServerAlertConfig, ChatMacroManager	Low	Saves and loads configuration data	Java NIO file APIs
commands.subcommands.NewCommandsCommand	Low	Can write a command “dump” output file	executeDump(..., String outputFile)
features.CapeManager	Low	Makes HTTP requests, likely for cape/cosmetic functionality	Java HTTP client API
features.cosmetics.CosmeticCatalog	Low	Contains Sketchfab cosmetic/model attribution links	Hard-coded Sketchfab URLs
features.cosmetics.GlbCosmeticModel	Low	Loads cosmetic model data from files	Java NIO file API
features.screens.mainmenu.alerts.HallOfFame	Low	Downloads a public Hall of Fame JSON file	GitHub raw URL in refreshIfStale()
features.screens.mainmenu.alerts.HallOfShame	Low	Downloads a public Hall of Shame JSON file	GitHub raw URL in refreshIfStale()
compat.MeteorCompat	Low	Uses reflection for compatibility checks	Reflection APIs in account/module/title-screen methods
features.ChatMacroManager / AsyncConfigs	Low	Uses reflection alongside configuration handling	Reflection APIs reported; exact use not shown

Bundled Third-Party Libraries

No suspicious bundled third-party library classes were identified in the supplied report.

The JAR includes third-party asset attribution in THIRD_PARTY_ASSETS.md, with Sketchfab links for cosmetic models. These are attribution/documentation URLs, not proof that the JAR downloads or executes content from Sketchfab.

Network Activity

The scan found the following identified network destinations:

• DupersUnited backend:

  • https://dupersunited-server.dupers.wtf
  • wss://dupersunited-server.dupers.wtf/ws/public
  • wss://dupersunited-server.dupers.wtf/ws/private
    The mod contains authentication and WebSocket connection code for this service. The report identifies the destination but does not reveal the full contents of messages sent or received.

• Official Minecraft services:

  • https://api.minecraftservices.com/minecraft/profile
  • https://api.minecraftservices.com/minecraft/profile/skins
  • https://api.minecraftservices.com/minecraft/profile/name/
    These are legitimate Mojang/Minecraft profile endpoints. The related methods use a token parameter to retrieve profile information or request skin/name changes.

• GitHub-hosted public lists:

  • Hall of Fame JSON from raw.githubusercontent.com/DupersUnited/halloffame
  • Hall of Shame JSON from raw.githubusercontent.com/DupersUnited/hallofshame
    The relevant methods are named refreshIfStale(), which suggests periodically refreshing displayed list data.

• Sketchfab links: cosmetic/model attribution links embedded in the mod and THIRD_PARTY_ASSETS.md.

• Project and community links: the mod metadata contains links to the project GitHub repository, issue tracker, websites, Discord servers, Instagram, and sponsorship page. These are ordinary metadata/community links, not connection code by themselves.

Deobfuscation and Analysis Coverage

The scan coverage was strong:

• 228 of 228 classes parsed successfully
• 228 of 228 classes had decompilation attempted
• 0 complete decompilation failures
• 1,659 methods containing code were scanned
• 3 classes had partial decompiler anomalies, about 1.3% of the JAR’s classes

The affected classes were PrideTheme, GlbCosmeticModel, and KeybindScreen. The reported errors were stack-underflow fallback messages while decoding certain methods. Two of these classes are related to themes/cosmetics, and one is a main-menu keybind screen. This is a small number of anomalies in otherwise fully parsed code and is not, by itself, strong proof of obfuscation or malware.

Reflection was found in compatibility and configuration-related code. Reflection lets Java code inspect or interact with classes dynamically; it can make code harder to review, but it is also common for cross-mod compatibility.

Is This Minecraft Mod Safe?

This appears to be a Fabric Minecraft mod, based on the included fabric.mod.json metadata and Minecraft client class names.

Its feature set includes cosmetic models, capes, chat macros, keybind/menu screens, account/session functions, proxy configuration, and server-connected authentication. Minecraft mods that manage accounts or interact with launcher paths should be treated more carefully than a simple visual-only mod, because they may need access to sensitive local game-account data. In this report, however, the scanner did not identify code proving that account credentials or session tokens are sent to the DupersUnited server.

What Looks Normal

• Configuration file access: Mods commonly save settings, alerts, chat macros, cosmetic data, and proxy configuration under their own config directories.
• A command dump feature: Writing an explicitly requested command output file is a normal utility feature.
• Minecraft profile requests: The detected Minecraft Services URLs are official profile, skin, and name endpoints.
• GitHub JSON refreshes: Fetching public “Hall of Fame” and “Hall of Shame” lists is consistent with the named menu-alert features.
• Sketchfab asset links: These appear to be cosmetic-model credits and asset references.
• Reflection for compatibility: MeteorCompat suggests reflection may be used to support or detect another Minecraft client/mod environment.
• Partial decompiler warnings: A few fallback warnings in complex UI/model code are not automatically obfuscation or malicious concealment.

What Is Dangerous

No major malware red flags were identified, but these unresolved areas deserve attention:

• The mod includes account/session features that resolve launcher-related paths. The scan does not prove misuse, but account-related features require a higher level of trust than ordinary cosmetic features.
• It maintains WebSocket-capable connections to dupersunited-server.dupers.wtf, including a separate /ws/private endpoint. The report identifies the endpoints but cannot determine all messages, server-side behavior, or future server responses.
• Proxy-related classes are present. Proxy settings can be legitimate, but users should understand why a mod needs them before enabling related features.
• The JAR’s behavior depends partly on remotely provided data from its backend and GitHub. Static scanning cannot verify what those servers may return later.

What Should You Do?

• Download the mod only from the project’s official GitHub or a trusted official release source.
• Verify that the file hash matches the expected release hash when the publisher provides one. This scanned file’s SHA-256 is 0b35ae9d32c2ca470378f1c5d6506c62ec9d436f1c7892c87a84efa99938b9ea.
• If you do not need account, proxy, or server-authentication features, avoid enabling them.
• Use a separate Minecraft account or a non-primary environment if you are uncomfortable giving a client mod access to launcher/account-related files.
• Monitor the mod’s outbound connections with a firewall or network monitor if you want to verify runtime behavior.

Scan Limitations

A static JAR scanner examines code and embedded strings without running the mod. It can identify many risky capabilities and known patterns, but it cannot prove complete safety, inspect future server responses, or fully determine what data a WebSocket message contains at runtime.

This report also cannot establish whether the publisher’s backend remains trustworthy after the scan. Use the source and release channel, account permissions, and the mod’s stated features as part of your decision.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A JAR can contain malicious Java code, including credential theft, downloads, unwanted network activity, or destructive actions. This report found no high-signal malware behavior in this JAR, but no static scan can guarantee that any file is completely safe.

How do I check whether a JAR file is safe?

Check its source and publisher, compare hashes when available, scan it, inspect requested permissions and network destinations, and test it in a separate Minecraft profile or isolated environment. For this JAR, the main areas to evaluate are its account/session features and its connection to the DupersUnited backend.

Can this scanner detect a Minecraft RAT?

It can identify common RAT indicators such as remote command execution, process launching, persistence, suspicious hidden downloads, credential theft patterns, and unexplained network control channels. This report found no evidence of those high-signal RAT behaviors.

Does obfuscation mean a JAR is malicious?

No. Obfuscation can be used for intellectual-property protection, compatibility reasons, or to reduce file size. Here, only three classes had partial decompiler fallback warnings, and the report does not show strong obfuscation or anti-analysis behavior.

Final JAR Safety Verdict

Verdict: Use caution
Risk level: Moderate
Confidence: Medium

Should I trust this JAR, and why? The scan does not show malware-like behavior such as token theft, hidden downloads, destructive commands, persistence, or remote control. Most findings match the mod’s stated-looking functionality: configs, cosmetics, Minecraft profile actions, public list refreshes, and project/community links. However, this is not a purely local mod: it includes account and launcher-path handling, proxy-related code, and persistent WebSocket-capable connections to the DupersUnited backend, including a private endpoint. The report cannot confirm what information is exchanged with that backend at runtime. Use it only if you trust the publisher and understand or do not enable its account, proxy, and authentication features.