Is p3nis-debug-1.0.0.jar Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

This JAR scanner inspected all 44 classes in p3nis-debug-1.0.0.jar, including 389 methods containing code. Every class parsed and decompiled successfully, with no decompiler anomalies or failed classes. That gives the scan good visibility into the Java code packaged in the file.

Three classes were flagged for closer review. The main findings are local file access, Java reflection/class-loading features, and code that uses ProcessBuilder plus a shell command string. The JAR also contains a PowerShell script named assets/p3nis/spotify_bridge.ps1, which appears related to the class named SpotifyService. No network hosts, URLs, IP addresses, or outbound connection indicators were found in this report.

Some of these signals can be normal for a Spotify integration—for example, storing album artwork locally or launching a helper script—but process execution and script extraction need class-level context. The evidence below separates those expected possibilities from the unresolved parts.

Questions the Full Report Answers

• Does the JAR make outbound network connections or contact unknown domains?
• Is the process-launching behavior part of the JAR’s own code or a bundled library?
• Why does the JAR include a PowerShell script and a SpotifyService component?
• Is there evidence of credential theft, hidden downloading, remote control, or persistence?
• How much of the JAR’s code was successfully inspected?

Malware and Virus Findings

No high-signal malicious behavior was detected. The report does not show indicators of credential or token theft, hidden downloads, destructive file deletion, persistence at startup, data exfiltration, or unexplained outbound connections.

However, the JAR’s own SpotifyService code can extract a bundled PowerShell script and start a process through Java’s ProcessBuilder API. This is not automatically malware: it may be a local “bridge” used to communicate with Spotify or retrieve playback information. The scan does not include the script’s full contents or the exact command arguments, so its precise behavior cannot be confirmed from this report alone.

RAT Detection

The evidence is not consistent with a clear remote-access trojan (RAT). No remote-control endpoints, network destinations, download behavior, credential collection, or persistence mechanisms were identified.

The local process-launching feature is still worth reviewing because malware can use process execution, but the available evidence ties it to a specifically named Spotify bridge rather than a hidden remote-control feature.

Suspicious Classes and Evidence

Core JAR or Mod Code

All flagged classes are in the JAR’s own com.basta.p3nis packages, rather than clearly identifiable bundled third-party libraries.

Class	Severity	Behavior	Evidence
com.basta.p3nis.modules.SpawnerTags	Low / review	Uses reflection, meaning it can inspect or call code dynamically.	Reflection API detected; no malicious action was identified.
com.basta.p3nis.modules.SpotifyHUD	Low	Reads or writes local files, likely for Spotify HUD artwork.	tryLoadArt(int ver) uses Java NIO file APIs.
com.basta.p3nis.spotify.SpotifyService	Moderate / review	Manages local artwork files, extracts a script, and launches a process.	artPath(), constructor, extractScript(), and runBridge() were flagged. runBridge() uses ProcessBuilder and a shell string.

Bundled Third-Party Libraries

No suspicious third-party library classes were listed in the report. In particular, the suspicious behavior was not attributed to common shaded libraries such as metrics, database, logging, or HTTP utility libraries.

Network Activity

No domains, URLs, IP addresses, or outbound connection indicators were found by the scan.

This does not prove the JAR can never access the internet. For example, a PowerShell bridge or another external program could make its own connections after being launched. But this report contains no direct evidence that the JAR’s Java code contacts a remote server.

Deobfuscation and Analysis Coverage

• Classes found: 44
• Classes parsed: 44 of 44
• Classes decompiled: 44 of 44
• Parse failures: 0
• Decompiler failures: 0
• Decompiler anomaly classes: 0
• Methods with code inspected: 389

There are no reported signs of failed decompilation, intentionally confusing class names in the default package, or decompiler complexity problems. Reflection in SpawnerTags and class-loading behavior in SpotifyService make those specific code paths somewhat harder to assess, but they are not, by themselves, proof of obfuscation or malware.

What Looks Normal

• A Spotify HUD commonly needs to load album artwork from local files, which reasonably explains file-related methods such as tryLoadArt() and artPath().
• A dedicated SpotifyService and a bundled script named spotify_bridge.ps1 suggest the script is intended to support the Spotify feature rather than being an unrelated hidden payload.
• Reflection is commonly used by plugins and mods for compatibility with different game/server versions or optional features.
• The report found no hidden network targets, URLs, or known remote endpoints.
• Full parsing and decompilation coverage means the scanner was able to inspect the Java classes rather than being blocked by broken or heavily protected bytecode.

What Is Dangerous

• The JAR can extract a PowerShell script from its archive and launch it through ProcessBuilder.
• The exact contents and command-line arguments of spotify_bridge.ps1 are not included in this report, so the script’s real actions remain unresolved.
• This behavior is in the JAR’s own Spotify code, not merely in a common bundled library.

There are no major red flags for credential theft, remote administration, destructive actions, hidden downloading, or direct data exfiltration in the supplied scan results.

What Should You Do?

• Only use it if you expected a Spotify integration or Spotify HUD feature.
• Obtain it from the original, reputable project source rather than a repost or random file host.
• Before using it on an important machine or server, inspect assets/p3nis/spotify_bridge.ps1 and the runBridge() method, or ask the developer to explain what the script starts and why.
• Run it first in a test environment if possible.
• Do not grant unnecessary administrator privileges to Java, the game launcher, or PowerShell for this JAR.

Scan Limitations

Static JAR scanning reduces risk by examining packaged code and known behavior indicators, but it cannot prove a file is completely safe. This report does not show the full behavior of the extracted PowerShell script, and it cannot observe everything that may happen at runtime or through external programs.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A JAR can contain harmful Java code, bundled scripts, or files that launch other programs. This report did not detect clear virus-like behavior, but it did identify a bundled PowerShell script that the JAR can execute.

How do I check whether a JAR file is safe?

Check its source, publisher reputation, file hash, permissions, network behavior, and scan results. For this JAR, the most useful additional check is opening and reviewing assets/p3nis/spotify_bridge.ps1 before running it.

Can this scanner detect a Minecraft RAT?

It can identify common RAT-related warning signs such as remote endpoints, command execution, downloads, credential theft, persistence, and suspicious obfuscation. This scan found process execution but did not find the other major RAT indicators.

Does obfuscation mean a JAR is malicious?

No. Developers sometimes use obfuscation for ordinary reasons. In this report, there were no decompiler failures or anomaly indicators suggesting significant obfuscation.

Final JAR Safety Verdict

Verdict: Use caution
Risk level: Moderate
Confidence: Moderate

Should I trust this JAR, and why? Use caution rather than treating it as automatically safe or malicious. The scan fully inspected the Java classes and found no evidence of credential theft, remote-control behavior, hidden downloading, persistence, destructive actions, or direct outbound connections. However, the JAR’s own SpotifyService extracts and runs a bundled PowerShell script, and the report does not reveal exactly what that script does. This can be legitimate for a Spotify bridge feature, but it is a meaningful capability that should be verified from a trusted source or by inspecting the script before use.