Is iris-1.7.6_mc1.20.1.jar Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

This JAR scan inspected iris-1.7.6_mc1.20.1.jar, a 2.73 MB Java archive containing 987 classes and 5,994 methods. All 987 classes were parsed successfully, and the decompiler attempted and completed analysis for all of them. The scanner marked 28 classes (2.84% of the archive) for review, mainly because they access files, enumerate shader-pack folders, import packs, or write configuration and diagnostic output.

The scan also found hardcoded links to github.com and irisshaders.dev. These links appear to be the Iris project page, issue tracker, and website. One class had a minor decompiler anomaly while reading a rendering-pipeline method, but the rest of the class and archive remained analyzable.

Scanner flags need context: file access is expected in a shader mod that loads ZIP shader packs, reads shader files, saves settings, and can export textures. The class-level evidence below helps distinguish those normal features from genuinely harmful behavior.

Questions the Full Report Answers

• Are the file and folder access flags related to shader packs and configuration files?
• Do the detected web links indicate hidden downloads or simply project and support links?
• Is the flagged reflection and class-loading behavior tied to compatibility features?
• Was enough of the JAR successfully analyzed to assess its code?
• Is there evidence of a Minecraft RAT, credential theft, or remote command execution?

Malware and Virus Findings

No high-signal malicious behavior was detected.

The report does not show evidence of credential theft, token grabbing, browser-data collection, hidden payload downloads, operating-system command execution, startup persistence, destructive file deletion, ransomware-like behavior, or unexplained data exfiltration.

The detected file operations are concentrated in Iris’s shader-pack, configuration, texture-export, and file-selection features. The detected URLs are project-related links to GitHub and the Iris website, rather than suspicious download servers or unknown IP addresses.

RAT Detection

The evidence is not consistent with a remote-access trojan (RAT).

There are no reported indicators of remote command control, command execution, persistence, hidden background control channels, credential collection, or covert outbound connections. The only network-related findings are hardcoded HTTPS URLs for the Iris project, issue tracker, and website.

Suspicious Classes and Evidence

Core JAR or Mod Code

The scanner’s “suspicious” label mostly reflects broad rules for file access and reflection. In this JAR, the flagged classes are part of the net.irisshaders.iris package and their names match expected shader-mod functions.

Class	Severity	Behavior	Evidence
net.irisshaders.iris.Iris	Low / review	Loads external shader packs, reads and updates configuration, locates the shader-pack directory	Java NIO file access, folder enumeration, and class-loader API use in shader-pack validation/loading methods
net.irisshaders.iris.config.IrisConfig	Low	Loads and saves Iris configuration	File access in initialize, load, and save
net.irisshaders.iris.gui.FileDialogUtil	Low	Lets the user choose files through a file dialog	File-selection method using Java file APIs
net.irisshaders.iris.gui.screen.ShaderPackScreen	Low	Imports shader-pack options and handles dropped shader-pack files	File access in pack import and file-drop handlers
net.irisshaders.iris.shaderpack.*	Low	Reads shader-pack files, properties, includes, textures, and program sources	Extensive file access consistent with loading local shader packs
net.irisshaders.iris.shaderpack.discovery.ShaderpackDirectoryManager	Low	Lists and copies shader packs into the shader-pack folder	File access and directory enumeration
net.irisshaders.iris.texture.*	Low	Exports or dumps textures for diagnostics/debugging	File-writing APIs in texture export/dump methods
net.irisshaders.iris.compat.dh.DHCompat	Low / review	Compatibility support for another mod or rendering environment	Reflection API use; no network, command, or credential-related evidence
net.irisshaders.iris.LaunchWarn	Low	Contains a link to the Iris website	Literal URL: https://irisshaders.dev
net.irisshaders.iris.pipeline.transform.transformer.CompatibilityTransformer	Low	References an Iris GitHub issue for compatibility context	Literal URL: GitHub issue 509

One class-loader-related flag appears in Iris’s shader-pack loading and validation logic. Loading shader packs from folders or ZIP files can legitimately require special handling of resources and classes. The report does not show that this feature downloads or executes external code.

Bundled Third-Party Libraries

No suspicious bundled third-party library classes were identified in this report.

The scanned classes flagged for review are predominantly Iris’s own net.irisshaders.iris code. The report does not identify common telemetry, database, HTTP-client, or process-launching libraries as the source of the alerts.

Network Activity

The scanner found hardcoded HTTPS URLs, but a hardcoded URL alone does not prove that the mod automatically connects to it.

Detected hosts and URLs:

• github.com
  • https://github.com/IrisShaders/Iris
  • https://github.com/IrisShaders/Iris.git
  • https://github.com/IrisShaders/Iris/issues
  • https://github.com/IrisShaders/Iris/issues/509
• irisshaders.dev
  • https://irisshaders.dev

The GitHub links are stored in fabric.mod.json and Iris classes, and appear to identify the project repository and issue tracker. No unknown domains, raw IP addresses, credential endpoints, file-hosting links, or suspicious download URLs were reported.

Deobfuscation and Analysis Coverage

Analysis coverage was strong:

• Classes in JAR: 987
• Classes parsed successfully: 987
• Classes failed to parse: 0
• Classes decompiled: 987
• Decompiler failures: 0
• Classes with decompiler anomalies: 1 of 987 (about 0.1%)

The one anomaly was in net.irisshaders.iris.Iris, in the method createPipeline(NamespacedId dimensionId). The decompiler reported a stack-underflow fallback while interpreting one instruction. This is a minor analysis issue, not proof of obfuscation or malware—especially because the scanner still analyzed every class and reported no decompilation failures.

The report also notes reflection and class-loader APIs. These can make code harder to inspect automatically, but here they appear in compatibility and shader-pack handling areas rather than alongside malware-like behavior.

Is This Minecraft Mod Safe?

This appears to be the Iris shader mod for a Fabric-based Minecraft installation, based on the fabric.mod.json file and the net.irisshaders.iris package name.

Its flagged behavior fits a shader mod’s normal job:

• Finding and listing local shader packs
• Reading shader files and ZIP-based packs
• Loading shader configuration files
• Saving Iris settings
• Importing shader-pack options
• Exporting textures or diagnostics when requested
• Linking users to the project website and issue tracker

The report does not show behavior normally associated with a malicious Minecraft mod, such as stealing Minecraft session tokens, Discord tokens, launcher credentials, browser data, or installing a persistent remote-control component.

What Looks Normal

• Shader-pack file access: Iris needs to read local shader files, properties, includes, textures, and ZIP packs.
• Shader-pack directory enumeration: Listing available shader packs is an expected feature.
• Configuration reads and writes: IrisConfig loads and saves the mod’s settings.
• File picker and drag-and-drop imports: These support user-selected shader packs and options.
• Texture export/dump code: Useful for debugging and rendering diagnostics; the report does not indicate hidden collection or uploading of those files.
• Reflection-based compatibility code: DHCompat likely uses reflection to work with optional external compatibility targets without requiring them to always be installed.
• GitHub and project-site links: The listed URLs point to the Iris repository, issue tracker, and official website.

What Is Dangerous

No major red flags were found in this report.

The only unresolved item is a single minor decompiler fallback in a rendering-related method. Static analysis could not fully reconstruct that one method’s instruction flow, but this happened in only 1 out of 987 classes and was not accompanied by suspicious network, process, credential, or persistence behavior.

What Should You Do?

• Download Iris from its official project page or a well-known mod platform, not from repost sites or random Discord attachments.
• If possible, compare the JAR’s SHA-256 hash with the hash published by the trusted source. This file’s reported SHA-256 is 9eb15e563e0c9ae6eff15b7863f8432dd290cf9f724c7373e9b15b14aa829ed5.
• Use the version intended for your Minecraft and Fabric setup.
• Keep the mod and your loader updated, especially when moving between Minecraft versions.
• If this file came from an untrusted source, prefer downloading a fresh copy from the official Iris distribution source.

Scan Limitations

Static JAR scanning reduces risk by inspecting code, strings, APIs, and archive contents, but it cannot prove a file is completely safe. It may not fully reveal behavior that only occurs with a specific game setup, external shader pack, server, environment, or future remote service change.

A clean-looking scan also does not confirm that the file was obtained from the official publisher. Source verification and hash comparison remain important.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A Java JAR can contain malicious code, including credential stealers, hidden downloaders, remote-control tools, or destructive actions. This scan found no high-signal evidence of those behaviors in this JAR.

How do I check whether a JAR file is safe?

Check where it was downloaded from, compare its hash with an official release if available, scan its contents, and look for suspicious behavior such as credential access, unknown network connections, command execution, persistence, or hidden downloads. For this file, the scan found mostly shader-pack and configuration-related file access.

Can this scanner detect a Minecraft RAT?

It can flag common RAT-related signs such as remote-control behavior, suspicious connections, command execution, credential theft, persistence, and hidden payload loading. This report does not contain those indicators.

Does obfuscation mean a JAR is malicious?

No. Obfuscation or decompiler problems can occur in legitimate Java software because of compiler behavior, transformations, compatibility code, or complex bytecode. This report found one minor decompiler anomaly, not widespread obfuscation or anti-analysis behavior.

Final JAR Safety Verdict

Verdict: Trust
Risk level: Low
Confidence: High

Should I trust this JAR, and why? Based on this scan, this JAR looks consistent with a legitimate Iris Minecraft shader mod. Nearly all flagged behavior is expected for loading local shader packs, managing configuration, importing files, and exporting rendering diagnostics. The only network-related findings are links to the official Iris website and GitHub project pages, with no evidence of hidden downloads or unknown outbound destinations. The scan found no signs of credential theft, RAT behavior, destructive actions, process execution, persistence, or data exfiltration. Still, trust the file most when it was downloaded from an official Iris source and its hash matches the published release.