[!WARNING] Final verdict available at the end of this report.
This JAR contains 494 classes, and the scanner successfully parsed and attempted to decompile all 494 of them. No classes failed parsing or decompilation. The scan identified 24 classes (about 4.9% of the JAR) with generic indicators such as file access, reflection, network-related APIs, a hardcoded website URL, or process-launching APIs.
Six classes had minor decompiler anomalies, mostly “stack underflow” errors in individual methods. These occurred in configuration, dungeon-map, dojo, and alert-related code. Such errors can result from compiler-generated Kotlin/Java bytecode or unusually complex methods; they require context but do not automatically mean the JAR is encrypted, malicious, or intentionally hidden.
The areas worth closer inspection are the mod’s use of reflection in several feature classes, a generic URL/network API in LocationHelper, unusually named methods involving session, user, url, and payload, and a ProcessBuilder call used by the configuration screen to open https://jooon.xyz.
No high-signal malicious behavior was detected. The report does not show evidence of credential theft, token grabbing, hidden payload downloads, destructive commands, persistence mechanisms, remote command execution, or confirmed data exfiltration.
The scanner did find APIs that can be used for file access, network access, reflection, and process launching. These are capabilities rather than proof of abuse. In this report, the most concrete process-related finding is an openExternalLink(String url) method in the config screen, associated with the project website https://jooon.xyz.
Some methods have unclear names such as aBaBaBaBaB(String url, String payload) and methods accepting session and user values. The report flags them because reflection makes them harder to inspect, not because it confirmed that they transmit sensitive data.
The evidence is not consistent with a confirmed remote-access trojan (RAT). The report does not identify remote shell access, arbitrary command execution, a command-and-control server, persistence, hidden downloads, or code that takes control of the computer.
ProcessBuilder is present, but the reported method is named openExternalLink, in the mod’s configuration screen, and is linked to opening the Jooon website. That is different from evidence of executing attacker-controlled commands.
All flagged classes are under the mod’s own jooon.* packages; the report does not identify suspicious bundled third-party library classes.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
jooon.config.ui.JooonConfigScreen |
Moderate | Opens an external link; uses process-launch API | openExternalLink(String url) and https://jooon.xyz; likely intended to open the project site from the config UI |
jooon.features.slayers.LocationHelper |
Moderate | File access, reflection, generic URL API | Uses java.io.File, reflection, and java.net.URL; no destination URL was extracted |
jooon.features.farming.BazaarHelper |
Moderate | Reflection in methods accepting URL/payload data | Methods named xXxXxXxXxX(session, user) and aBaBaBaBaB(url, payload) need manual review because their behavior is not clear from this report |
jooon.util.OverlayScreen |
Moderate | Reflection in session/user-related methods | Reflection indicators in methods taking session and user; no confirmed network destination or data theft behavior reported |
jooon.config.ConfigDefinition |
Low | Reads and migrates configuration files | Uses Java NIO file APIs for config paths and JSON state migration |
jooon.config.JooonConfigManagerKt |
Low | Reads and writes JSON settings | Contains readJsonObject and writeJsonAtomically methods |
jooon.config.ui.JooonUiSettings |
Low | Loads and saves UI settings | File APIs used in ensureLoaded() and save() |
jooon.features.fishing.FishingMeleeStore |
Low | Loads and saves feature data | File APIs in load() and save() |
| Pathfinding and feature classes | Low | Generic file/reflection API detections | Includes pathfinding, dungeon solver, keybinding, overlay, and gameplay-feature classes; no malicious action was identified |
The reflection flags appear across gameplay, input, UI, and configuration-related code. Reflection is a Java feature that lets a program access methods or fields dynamically. It can make static analysis less clear, but it is also commonly used by Minecraft mods to interact with game internals, keybindings, or version-dependent code.
No suspicious bundled third-party library classes were listed in this report. In particular, the findings are not attributed to common shaded libraries such as bStats, HSQLDB, SLF4J, Apache Commons, or HikariCP.
The report identifies the following explicit external address:
https://jooon.xyz/ — listed in fabric.mod.json, likely the mod or project homepage.https://jooon.xyz — referenced by JooonConfigScreen, apparently when a user clicks something in the configuration interface.Other network-related evidence:
LocationHelper uses the generic Java URL API.The report does not show that the mod automatically contacts jooon.xyz; it shows that the config UI contains a link to it.
The six anomaly classes are all in the mod’s own code, including configuration UI, dojo, dungeon-map, and Jerry-alert features. Five contain decompiler “stack underflow” messages, and several have dense branching.
These anomalies affect a small portion of the JAR. They mean the decompiler had trouble reconstructing some methods exactly; they do not prove deliberate obfuscation or malware. Importantly, the scanner still completed its inspection of every class and did not report fully inaccessible or encrypted classes.
This appears to be a Fabric Minecraft mod: it contains fabric.mod.json and code referencing Minecraft client classes, dungeon features, pathfinding, UI screens, keybindings, and gameplay helpers.
The file-access findings are broadly compatible with a Minecraft mod saving configuration, UI preferences, paths, or feature state. Reflection is also common in client mods that need to access Minecraft internals across different versions.
However, this is a feature-heavy mod with some code that is less transparent to a static scanner, including reflection, generic URL support, and unclear method names involving session/user and URL/payload parameters. Those findings do not establish malicious behavior, but they prevent treating the scan as completely clean.
load() and save() methods.ProcessBuilder to open the project website externally when clicked.No major red flags such as confirmed credential theft, hidden downloads, persistence, destructive actions, or remote-control functionality were found.
The unresolved points are:
LocationHelper has a generic network URL API but no extracted destination.BazaarHelper contains reflection-based methods with unclear names and url/payload parameters.OverlayScreen contains reflection-based methods accepting session and user parameters.3a91aef3f7aaebf16a0d79dbb7e20060dd663afadd83d3f21e688c315cab4600jooon.xyz.A static JAR scanner inspects code and embedded strings without running the mod. It can identify suspicious APIs and known indicators, but it cannot prove that a JAR is completely safe or show every behavior that happens only at runtime.
Reflection, dynamically constructed URLs, server-delivered data, and code paths activated only in certain Minecraft situations can reduce visibility. A clean result for credential theft or RAT behavior means none was found in this scan evidence, not that such behavior is impossible.
Yes. A Java JAR can contain harmful code, including credential stealers, downloaders, or remote-control tools. In this report, no high-signal malicious behavior of that kind was detected.
Use a JAR malware scanner, verify the download source and file hash, inspect requested permissions or behavior, and monitor unexpected network activity. For Minecraft mods, downloading from the official developer page or a well-known platform is especially important.
It can detect common RAT-related signs such as command execution, hidden downloads, persistence, remote-control endpoints, and suspicious networking. This report does not show a confirmed Minecraft RAT pattern.
No. Obfuscation or decompiler errors can occur in legitimate software, especially Kotlin-based or complex Minecraft mod code. Here, only 6 of 494 classes had decompiler anomalies, and the scan did not report broad anti-analysis protection or inaccessible code.
Verdict: Use caution
Risk level: Moderate
Confidence: Medium
Should I trust this JAR, and why? The scan does not show the strongest signs of malware: there is no detected credential theft, hidden downloader, persistence mechanism, destructive command behavior, or RAT-like remote control. Much of the flagged activity is consistent with a Minecraft mod saving settings, interacting with game code, and opening its own website from a configuration screen. However, several classes in the mod’s own code use reflection, and a few unclear methods involve session/user or URL/payload parameters without enough evidence to explain their purpose. Use it only if it comes from a trusted official source, and consider monitoring its network behavior before using it with an account or setup you cannot easily replace.