Is keystrokes.jar Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

The scanner inspected keystrokes.jar, a 2.0 MB Java archive containing 1,018 classes and 8,628 methods. All 1,018 classes were successfully parsed and decompiled, with no parse failures, decompiler failures, suspicious archive entries, or decompiler-anomaly warnings. This gives the report unusually complete static-code coverage.

The scan marked 125 classes (about 12%) for closer review. The main reasons were file access, network and WebSocket support, reflection/class-loading features, and hardcoded URLs. Many of those findings belong to bundled Minecraft Mixin/ASM code, the Java-WebSocket library, and SLF4J logging code, which routinely trigger generic scanner rules.

The most important code to inspect is the JAR’s own keystrokesmod.script package. It includes a script manager, a custom class loader, HTTP requests, WebSockets, local script/config-file handling, and a method with a sendHardwareId parameter. These capabilities can support legitimate client scripting features, but they need more scrutiny than ordinary keystroke-display code.

Questions the Full Report Answers

Malware and Virus Findings

No high-signal malicious behavior was detected. The report does not show evidence of credential or token theft, browser-data collection, hidden executable downloads, operating-system process execution, ransomware-like file encryption, destructive file wiping outside of its own apparent profile/script features, startup persistence, or confirmed data exfiltration.

One item deserves context: keystrokesmod.utility.NetworkUtils contains a method named getTextFromURL(String _url, boolean appendNewline, boolean sendHardwareId). The scanner identifies the networking API but does not show what data is actually sent, whether the hardware-ID option is used, or which endpoint receives it. Its presence is an unresolved privacy concern, not proof that data is collected or transmitted.

The scanner also detected an HTTP request method labelled network_http_upload_combo in the script API. This means the code can make HTTP requests that may send data, but the report does not establish a malicious destination, a stolen-data source, or actual use of that feature.

RAT Detection

The evidence is not consistent with a confirmed remote-access trojan (RAT). The report contains no confirmed remote shell, command-and-control endpoint, process-launching code, credential collection, persistence mechanism, or hidden downloader.

However, the JAR includes a script engine, reflection, a custom class loader, HTTP support, and WebSocket support. Those are powerful features that can be used legitimately for in-game scripting, but they also mean the mod has more capability than a simple keystrokes overlay. Static scanning alone cannot determine which scripts a user may later load or which user-provided server address a WebSocket client might contact.

Suspicious Classes and Evidence

Core JAR or Mod Code

Class Severity Behavior Evidence
keystrokesmod.script.Script Medium Runs scripts, accesses files, uses reflection and class loading run(), invoke(...), delete(); class loader and reflection APIs detected
keystrokesmod.script.ScriptManager Medium Loads scripts from local files and calculates hashes loadScripts() enumerates files; calculateHash(File) uses cryptographic APIs
keystrokesmod.script.SecureClassLoader Medium Custom class loader for script-related classes loadClass(...) and isClassSafe(...)
keystrokesmod.script.model.Request Medium General HTTP request capability, potentially including uploads fetch() uses URL/HTTP connection APIs; scanner flagged an HTTP-upload combination
keystrokesmod.script.model.WebSocket Medium Connects to a WebSocket endpoint supplied as a URI Constructors accept serverURI / serverUri; connect(...)
keystrokesmod.utility.NetworkUtils Medium Makes HTTP requests; includes an optional hardware-ID-related parameter getTextFromURL(..., sendHardwareId); URL connection APIs
keystrokesmod.utility.ProfileUtils Low Looks up Mojang profiles and Hypixel player statistics Hardcoded Mojang and Hypixel API URLs
keystrokesmod.clickgui.AbstractClickGui Low Opens a release page from the GUI Codeberg releases URL
keystrokesmod.script.Manager Low–Medium Stores and retrieves local script settings; references Raven documentation Config-file APIs and GitBook URL
keystrokesmod.utility.profile.ProfileManager Low Saves, imports, deletes, and enumerates mod profiles Profile file-management methods; Base64 import support

The key concern is not the normal profile/config handling. It is the combination of a local script loader, dynamic class loading, reflection, and flexible outbound HTTP/WebSocket support. The report does not prove that these features are abused, but they create a wider trust boundary: scripts and settings imported into the mod matter too.

Bundled Third-Party Libraries

Class/package Severity Behavior Evidence
org.java_websocket.* Low Standard WebSocket client/server library Numerous socket and WebSocket classes; no suspicious hardcoded control server found
org.slf4j.* Low Standard Java logging framework SLF4J documentation URLs and service-loading/reflection behavior
org.spongepowered.asm.* Low Minecraft Mixin/ASM runtime and bytecode transformation framework Reflection, class loading, bytecode tools, and file APIs typical of Mixin tooling

Most of the 125 flagged classes come from these bundled libraries. In particular, the large number of WebSocket, socket, reflection, class-loader, and file-related hits in org.java_websocket, org.slf4j, and org.spongepowered.asm should not be read as evidence that the mod itself is malware.

Network Activity

The following hardcoded domains and URLs were identified:

The report does not list any hardcoded unknown IP addresses, suspicious-looking command server domains, raw file-hosting download URLs, or obvious credential-collection endpoints.

There is also generic outbound networking in the mod’s own script API:

Because these APIs accept URLs or server URIs as parameters, static analysis cannot identify every possible destination. This is more flexible than a mod limited to the listed Mojang, Hypixel, Imgur, Codeberg, and GitBook addresses.

Deobfuscation and Analysis Coverage

There is no scanner evidence that this JAR tried to prevent decompilation through malformed classes, failed parsing, hidden archive entries, or obvious anti-analysis tricks.

Reflection and custom class loaders were detected, but their locations provide context. Much of this is from the included Sponge Mixin framework, which Minecraft mods commonly use to modify game behavior at runtime. The script subsystem’s own class loader remains notable because it is designed to load script-related classes dynamically.

Is This Minecraft Mod Safe?

This appears to be a Minecraft client mod rather than a server plugin. It contains Minecraft-related code, Mojang and Hypixel API integration, and the Sponge Mixin framework commonly used by Forge-era Minecraft mods.

For ordinary Minecraft use, Mojang profile lookups, Hypixel statistics/API-key validation, local configuration files, profiles, and Mixin class transformation are normal mod features. The more unusual feature is the included script manager: users should treat downloaded or imported scripts as separate code they must trust.

What Looks Normal

What Is Dangerous

No major malware red flags were confirmed by the scan.

The remaining concerns are capability-based rather than confirmed malicious actions:

What Should You Do?

Scan Limitations

This is a static JAR security scan: it examines the code packaged in the archive, but cannot prove complete safety. It cannot fully determine runtime behavior, whether external scripts are trusted, what URLs a user supplies to the script API, or whether a legitimate-looking release was altered before you downloaded it.

A clean decompilation result and lack of high-signal malware findings reduce risk, but they do not replace downloading from a trusted source and reviewing network activity during use.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A JAR can contain Java code that steals data, downloads payloads, runs commands, or changes files. This report did not detect those high-signal behaviors in keystrokes.jar, but a JAR is still executable code and should be sourced carefully.

How do I check whether a JAR file is safe?

Check its source, compare its hash with an official release when available, scan it, inspect its network behavior, and avoid loading untrusted add-ons such as scripts or imported profiles. This scan fully parsed and decompiled this JAR, which is useful evidence, but not a complete guarantee.

Can this scanner detect a Minecraft RAT?

It can identify common RAT indicators such as credential theft, remote command execution, persistence, hidden payload downloads, suspicious endpoints, and anti-analysis patterns. This report found no confirmed RAT-style behavior, though the mod’s scripting and networking features deserve care.

Does obfuscation mean a JAR is malicious?

No. Many Minecraft mods are obfuscated or use runtime class transformation. In this case, the scanner reported no decompiler anomalies or failed classes, and much of the reflection/class-loader activity comes from standard Mixin infrastructure.

Final JAR Safety Verdict

Verdict: Use caution
Risk level: Moderate
Confidence: Moderate

Should I trust this JAR, and why? The scan does not show the usual evidence of a virus or Minecraft RAT: no credential theft, hidden downloader, operating-system command execution, persistence, destructive behavior, or confirmed exfiltration was detected. Most flagged classes are normal bundled Minecraft Mixin, WebSocket, and logging libraries, while the named domains are mainly Mojang, Hypixel, Imgur, documentation, and release sites. However, the mod’s own code includes a powerful script loader with dynamic class loading, local file access, HTTP requests, and WebSocket connections, plus a hardware-ID-related networking parameter. Use it only from a verified source, and do not load untrusted scripts, profiles, or configurations into it.