[!WARNING] Final verdict available at the end of this report.
This 4.5 MB JAR is named forge-1.12.2-14.23.5.2864-installer.jar and appears to be a Minecraft Forge installer rather than an ordinary gameplay mod. The scan successfully parsed and decompiled all 305 classes, covering 1,723 methods containing code. No parsing failures, decompiler failures, or decompiler anomalies were reported.
The scanner marked 80 classes for review. Most of those flags are from bundled Gson JSON-library classes that use Java reflection, which is a normal technique Gson uses to convert Java objects to and from JSON. The Forge installer’s own classes also use network, file, archive, hashing, and class-loading functions—capabilities an installer needs to download Minecraft/Forge components, check their hashes, write them to the selected Minecraft directory, and process installation files.
The main areas requiring context are the installer’s download and file-writing functionality, its listed download locations, and a generic scanner flag combining network and file access. Those are expected capabilities for an installer, but they are important because installers inherently have more system access than a normal mod.
No high-signal malicious behavior was detected.
The report does not show evidence of credential or token theft, browser-data collection, hidden payload downloads from unknown domains, operating-system command execution, startup persistence, ransomware-like file destruction, or deliberate data exfiltration. It also does not report suspicious IP addresses, encrypted command-and-control traffic, or unknown hardcoded collection endpoints.
The installer does download files and write them to disk, but this is directly represented in methods named downloadLibrary, downloadFile, extractFile, and installation actions such as ClientInstall and ServerInstall. These are expected functions for a Forge installer. The scanner’s network_http_upload_combo label is a generic capability-based flag caused by network and file APIs appearing together; the report does not provide evidence that this JAR uploads local files or personal data.
The evidence is not consistent with a remote-access trojan (RAT).
No remote command execution, shell/process launching, covert persistence, credential capture, arbitrary remote-control channel, or unknown command server was identified. Network-related code is tied to dependency downloads, Minecraft version metadata, Forge files, and installer mirrors.
The core Forge installer classes are flagged mainly because an installer must download files, create or modify installation files, verify hashes, unpack archives, and load processing components.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
net.minecraftforge.installer.DownloadUtils |
Review | Downloads libraries and Minecraft metadata; writes and extracts files; checks certificates and hashes | References libraries.minecraft.net and launchermeta.mojang.com; methods include downloadLibrary, downloadFile, extractFile, and getSha1 |
net.minecraftforge.installer.SimpleInstaller |
Review | Main installer logic and Minecraft-directory file handling | References files.minecraftforge.net and launchermeta.mojang.com; includes getMCDir and installer log/file functions |
net.minecraftforge.installer.HashFunction |
Low / expected | Calculates file hashes to verify downloaded or installed files | Uses MessageDigest and file hashing methods |
net.minecraftforge.installer.actions.ClientInstall |
Review | Installs client files and injects a Forge profile | Reads and writes selected installation files |
net.minecraftforge.installer.actions.ServerInstall |
Review | Installs server-side files | Writes installer output to the selected target |
net.minecraftforge.installer.actions.OfflineAction |
Review | Packages/extracts installer resources for offline installation | Uses ZIP/archive and file-copy APIs |
net.minecraftforge.installer.actions.PostProcessors |
Review | Runs Forge installation post-processing on libraries and outputs | File handling plus reflection/class-loader APIs, consistent with installer processing |
net.minecraftforge.installer.json.Mirror |
Low / expected | Retrieves an image for a mirror entry | Uses Java URL support |
Reflection and class-loader use in PostProcessors deserve review in general because they can make code harder to follow. In this report, however, they occur in a component explicitly named for installation post-processing, and no malicious companion behavior was reported.
Most of the flagged classes are bundled dependencies, especially Gson and jOpt Simple—not Forge-specific malware-like code.
| Class / Library | Severity | Behavior | Evidence |
|---|---|---|---|
com.google.gson.* |
Low / expected | JSON serialization and deserialization | 60+ reflection-related review flags; Gson normally uses reflection to inspect fields and object types |
com.google.gson.internal.bind.TypeAdapters$21 |
Low / expected | Converts JSON text to Java URL objects |
Java URL API appears in a URL type adapter; this does not itself make a connection |
com.google.gson.internal.UnsafeAllocator |
Low / expected | Advanced object creation used by Gson | Reflection-related implementation detail |
joptsimple.internal.* |
Low / expected | Command-line argument parsing | Reflection used to convert command-line values into Java types |
The scanner marked 62 instances of “hard-to-review code API,” overwhelmingly due to reflection. Reflection is not automatically obfuscation or malware; it is standard in Gson and command-line libraries.
The JAR contains URLs in installer metadata, bundled license files, changelogs, and Maven project files. Many of these are documentation or license references rather than active connections.
Relevant installation-related destinations include:
https://libraries.minecraft.net/ — Minecraft library downloads.https://launchermeta.mojang.com/mc/game/version_manifest.json — Mojang’s Minecraft version manifest.https://launchermeta.mojang.com/ — Mojang launcher/version metadata service.https://files.minecraftforge.net/ — Forge distribution site.https://maven.minecraftforge.net/ — Forge Maven repository for installer dependencies.https://adoptium.net/ — Java runtime/provider reference.The included version.json lists expected third-party libraries such as ASM, Scala components, LaunchWrapper, Log4j, Trove, JOpt Simple, and Maven artifacts. This is normal for an older Forge installer that needs to assemble a compatible Minecraft 1.12.2 environment.
Other URLs point to GitHub, Apache, GNU, SourceForge, Minecraft Forum, and project documentation. The report identifies these primarily inside CREDITS.txt, license text, changelogs, POM metadata, and installation profile files. A URL stored in a license or POM is not evidence that the JAR contacts it.
This is strong static-analysis coverage. The report found no broken classes, malformed bytecode, decompiler confusion, or complexity anomalies that would suggest the JAR was deliberately made difficult to inspect.
The JAR does use reflection, cryptographic hashing, URL connections, file APIs, archive APIs, and a class loader. These deserve contextual review, but the named classes and methods align with normal installer work: parsing JSON, downloading known game files, verifying them, extracting archives, and processing installation data.
This is a Minecraft Forge installer for Minecraft 1.12.2, not a typical Forge mod placed into a mods folder. Its job is to install or configure the Forge loader and its required libraries for a client or server.
Because it is an installer, it is expected to:
These capabilities would be more concerning in an unrelated cosmetic mod or small utility, but they match the stated role of this file.
net.minecraftforge.installer.HashFunction and SHA-1-related methods are consistent with verifying downloaded files.No major malware red flags were found in this report.
The main unresolved practical concern is inherent to any installer: it can download files and write them into a Minecraft or server installation. If the JAR was obtained from an unofficial mirror, repost, Discord attachment, or modified archive, a scan of its behavior alone cannot prove it is the original Forge release.
The report’s SHA-256 is:
2c0065938de6df6f3deb4a08a3018940a1cc86111adb34a3be55d657857a11cc
Use that hash only after comparing it with a trusted official source or a known-good release record. A hash identifies the exact file scanned; it does not by itself prove who created it.
A static JAR scanner can inspect code structure, embedded URLs, APIs, and suspicious patterns, but it cannot prove a file is completely safe. It cannot guarantee what a remote server may return in the future, confirm the authenticity of the download source, or fully predict behavior triggered only in a specific system or network environment.
This report provides strong code coverage, but source authenticity and safe installation practices still matter.
Yes. A JAR can contain malicious Java code, bundled payloads, or code that downloads harmful files. In this report, no high-signal virus-like behavior—such as credential theft, remote control, destructive commands, or persistence—was detected.
Check where it came from, compare its SHA-256 hash against a trusted source when available, scan it, inspect its permissions and network destinations, and confirm that its behavior matches its purpose. For this installer, downloading Minecraft/Forge libraries and writing installation files are expected behaviors.
It can identify common RAT indicators such as unexpected command execution, remote-control patterns, suspicious network destinations, credential harvesting, persistence, and hidden downloads. This report contains no evidence consistent with those behaviors.
No. Some legitimate JARs are obfuscated to protect code or reduce size, and some libraries use reflection that can be difficult to review. Here, there were no decompiler anomalies or failed classes, and the reflection flags largely come from Gson and other normal dependencies.
Verdict: Mostly trust
Risk level: Low
Confidence: High
Should I trust this JAR, and why? The scanned file behaves like a Forge installer: it downloads known Minecraft and Forge dependencies, checks files with hashes, extracts archives, and writes installation files. All 305 classes were successfully inspected, with no decompilation anomalies or evidence of credential theft, hidden persistence, remote control, destructive commands, or unexplained data exfiltration. Most suspicious-class flags come from the bundled Gson library’s normal reflection behavior, while the Forge-specific network and file actions match installation duties. Trust it only if it came from an official Forge source or if its SHA-256 matches a trusted known-good copy; an installer from an unverified mirror should be replaced with an official download.