Is ZombiesAddon1.8.9-4.8.5.jar Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

This JAR contains 1,685 classes and approximately 16,020 methods. The scanner successfully parsed and decompiled all 1,685 classes, so there are no completely unreadable or uninspected classes in this report. It identified 167 classes with generic security-relevant APIs, including file access, networking, reflection, class loading, archive handling, and process-launching APIs.

Most flagged classes belong to bundled Kotlin and SpongePowered Mixin/ASM libraries. Those libraries provide normal runtime, file, reflection, and Minecraft mod-loading functionality, so their presence creates many automated alerts without automatically indicating malicious behavior. The report also found several findings in the addon's own code: GitHub-based update checking/downloading, a Pastebin URL used by a command, socket use in an AutoSplits feature, and a helper that starts a separate process to remove or replace files.

The most important areas to inspect are the updater, the command that contacts Pastebin, the socket-based command sender, and the process-launching file-removal helper. These require context because they can support legitimate mod features but can also increase the impact of a compromised update source or unexpected remote content.

Questions the Full Report Answers

• Does the addon contact known public services, or unknown external servers?
• Are most scanner alerts from the mod itself or from bundled Kotlin and Mixin libraries?
• Does the mod contain evidence of credential theft, remote administration, or destructive activity?
• Why does the addon include an updater, a file-removal helper, and process-launching code?
• How much of the JAR could actually be parsed and decompiled?

Malware and Virus Findings

No high-signal malicious behavior was detected. The scan did not identify code clearly associated with credential theft, token grabbing, browser-data theft, ransomware-style encryption, destructive disk wiping, hidden persistence, or direct data exfiltration.

However, the addon's own AutoUpdater can download releases from the project's GitHub repository, write files locally, calculate SHA-256 hashes, and work with a separate file-removal helper. This can be a legitimate self-update design, but update functionality is security-sensitive: if the GitHub project or release process were compromised, the addon could potentially retrieve a malicious update.

The report also found a Pastebin raw URL in a command class and a socket-based command sender. The scan does not provide enough code-level detail to establish exactly what data is retrieved from Pastebin or what destination the socket connects to.

RAT Detection

The evidence is not consistent with a clear remote-access trojan (RAT). The scan found no direct evidence of a hidden remote shell, a command-and-control server, persistence mechanism, credential collection, or code designed to silently control the computer.

There is nevertheless some unresolved remote-capable functionality: a socket connection in AutoSplits, a command class referencing Pastebin, and an updater that downloads releases. These do not prove remote control, but they are more important to review than ordinary library alerts.

Suspicious Classes and Evidence

Core JAR or Mod Code

Class	Severity	Behavior	Evidence
kr.hahaha98757.zombiesaddon.update.AutoUpdater	Medium	Downloads and applies updates from GitHub releases; accesses local files; calculates SHA-256	github.com/.../releases/download/, URL connection APIs, file APIs, crypto API
kr.hahaha98757.zombiesaddon.update.UpdateChecker	Low–Medium	Checks update metadata and release information	raw.githubusercontent.com/.../update.json, GitHub releases URL
kr.hahaha98757.zombiesaddon.commands.CommandZsv	Medium	A command can access Pastebin raw content and the project GitHub page	https://pastebin.com/raw/, URL connection APIs
kr.hahaha98757.zombiesaddon.modules.AutoSplits	Medium	Opens a socket connection in a method named sendCommand	Java socket API; destination is not identified in the report
kr.hahaha98757.zombiesaddon.utils.FileRemoverLauncher	Medium	Starts a separate process while working with files	ProcessBuilder in runAndQuit, likely related to replacing/removing locked mod files
kr.hahaha98757.zombiesaddon.utils.FileRemover	Low–Medium	Checks and removes files	Local file APIs
kr.hahaha98757.zombiesaddon.init.AutoDiscoveryMixinPlugin	Low	Scans directories/JARs to discover mixins	File walking, archive inspection, class URL handling
kr.hahaha98757.zombiesaddon.ZombiesAddon	Low	Creates or writes local files during mod initialization	File APIs in preInit and writeFile
Recorder, sound, JSON, and tools classes	Low	Read and write addon data, recordings, configuration, or custom sound files	Standard Java file APIs

Bundled Third-Party Libraries

Class group	Severity	Behavior	Evidence
kotlin.*	Low	Kotlin runtime support, file utilities, reflection, threading, URL helper methods	Most of the 167 flagged classes are Kotlin library code
org.spongepowered.asm.* / org.spongepowered.tools.*	Low	Mixin and ASM bytecode tooling used by Forge-era Minecraft mods	Reflection, class loading, class transformation, JAR and file APIs
Kotlin file/path helpers	Low	Generic support for reading, writing, copying, walking, and deleting files	java.io and java.nio.file APIs
Kotlin reflection and class loader helpers	Low	Runtime type and compatibility support	Reflection and class loader APIs
ASM/Mixin classes	Low	Minecraft class transformation and loading support	Class loader, reflection, bytecode inspection APIs

The scanner’s raw count of 167 suspicious classes is therefore misleading if read without context. The large majority are standard bundled Kotlin and SpongePowered Mixin components, not custom addon logic.

Network Activity

The report identified these external locations:

• GitHub project and release pages

  • https://github.com/hahaha98757/zombies-addon
  • https://github.com/hahaha98757/zombies-addon/releases
  • https://github.com/hahaha98757/zombies-addon/releases/download/
  • Used by the addon’s update UI and auto-updater.

• GitHub raw update metadata

  • https://raw.githubusercontent.com/hahaha98757/zombies-addon/main/update.json
  • https://raw.githubusercontent.com/hahaha98757/zombies-addon/dev/update.json
  • Used by UpdateChecker to check version information.

• Pastebin

  • https://pastebin.com/raw/
  • Referenced by CommandZsv. The report does not reveal the specific Pastebin item, downloaded content, or whether it is treated as executable instructions.

• Socket connection

  • AutoSplits.sendCommand uses Java’s socket API.
  • The report does not name the remote host, port, payload, or purpose. Its name suggests it may communicate with an external timer, tool, or game-related service, but that cannot be confirmed from this scan alone.

• Library documentation and metadata URLs

  • Maven, JetBrains, Apache, ObjectWeb, YouTrack, and related URLs appear in bundled library metadata or source comments.
  • These are not evidence that the mod contacts those sites during normal use.

Deobfuscation and Analysis Coverage

• Classes found: 1,685
• Classes parsed: 1,685 / 1,685
• Classes decompiled: 1,685 / 1,685
• Parse failures: 0
• Decompiler failures: 0
• Decompiler anomaly classes: 18 (about 1.1%)

The 18 anomalies were mostly decompiler “stack underflow” fallbacks in Kotlin standard-library classes, plus a few methods in the addon’s game, wave, recorder, and language code. This is a small percentage of the JAR and is not, by itself, evidence of obfuscation or malware.

The reported reflection, class-loader, and bytecode-manipulation APIs are largely from Kotlin and SpongePowered Mixin. Mixin is normal in Forge Minecraft mods because it modifies or integrates with Minecraft classes at runtime. The scan did not report widespread name scrambling, unreadable custom code, encrypted strings, or extensive anti-analysis techniques.

Is This Minecraft Mod Safe?

This appears to be a Forge-era Minecraft mod: it uses FML initialization and SpongePowered Mixin tooling, and its core package is kr.hahaha98757.zombiesaddon.

Normal Minecraft mod behavior explains much of the report:

• Mixin and ASM classes modify or inspect Minecraft classes during loading.
• File access is expected for mod configuration, recordings, custom sounds, update files, and local data.
• GitHub update checks are common for mods.
• A separate file-removal process can be used to replace a loaded JAR during an update, because Windows often prevents a running mod JAR from being overwritten directly.

The less routine findings are the Pastebin reference and unexplained socket use. They are not automatically malicious, but users should obtain this mod only from the project’s official release source and avoid treating unknown mirrors as trustworthy.

What Looks Normal

• Kotlin runtime bundled into the JAR: This accounts for many file, URL, reflection, and process-related API alerts. Generic library capabilities do not mean the addon uses every capability maliciously.
• SpongePowered Mixin/ASM: Standard infrastructure for many Forge mods that need to interact with Minecraft internals.
• GitHub update checker: The addon checks update.json from the project’s GitHub repository and points users toward GitHub releases.
• SHA-256 calculation: The updater includes a method named calculateSHA256, which is commonly used to verify an update file’s integrity.
• Local file access: Custom sounds, game recordings, categories, player records, JSON data, and settings naturally require reading and writing files.
• JAR and directory scanning: AutoDiscoveryMixinPlugin appears designed to locate mixin resources, which is normal for a mod loader integration.

What Is Dangerous

No major malware red flags such as credential theft, ransomware, hidden persistence, or a confirmed remote-control component were found.

The remaining concerns are:

• Automatic update downloading: AutoUpdater can download files from GitHub releases and write them locally. This is convenient but means the security of future updates depends on the security of that GitHub project and its releases.
• Process execution: FileRemoverLauncher starts a separate process. Its naming and nearby file-removal code suggest an update/replacement helper, but any process-launching capability deserves care.
• Pastebin access from a command: The report cannot establish what is requested from Pastebin or how it is used.
• Socket-based sendCommand: The destination and payload are not shown. This remains an unexplained network-capable feature in the mod’s own code.

What Should You Do?

• Download the JAR only from the developer’s official GitHub releases or a verified official mod page.
• Confirm the file hash if the developer publishes one. The scanned file’s SHA-256 is 381389f5df35040c3b5df52496ae9d18f345ea7530ab40dc7437aeb559766e61.
• Avoid unofficial reuploads, repacks, “fixed” builds, or versions shared through random file hosts.
• If you do not want automatic downloads, check whether the mod provides an option to disable auto-updating before using it.
• Consider blocking or monitoring unexpected network traffic, especially if you do not use features related to updates or AutoSplits.
• For a server or important installation, test the mod first in a separate Minecraft profile or test environment.

Scan Limitations

Static JAR scanning reduces risk by identifying code capabilities and known suspicious patterns, but it cannot prove that a file is completely safe. It cannot fully determine what a remote server returns, whether a future GitHub release is safe, what a socket sends at runtime, or whether behavior changes based on game state, configuration, or downloaded content.

This scan had excellent code coverage, but some conclusions still require runtime observation or manual review of the relevant methods.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A Java JAR can contain malicious code and can access files, network connections, processes, or Minecraft account/session data if the code is designed to do so. A JAR is not safe merely because it is a Minecraft mod.

How do I check whether a JAR file is safe?

Use a JAR malware scanner, compare the file hash with an official release, inspect where it was downloaded from, and review whether its network and file behavior matches its advertised purpose. For this JAR, the main items worth checking are the updater, Pastebin use, and socket feature.

Can this scanner detect a Minecraft RAT?

It can identify warning signs often associated with Minecraft RATs, such as credential access, token theft, hidden downloads, remote command execution, persistence, suspicious webhooks, or unexplained connections. This report did not find a clear RAT pattern, although it did identify a few network-capable features needing context.

Does obfuscation mean a JAR is malicious?

No. Many legitimate mods are compiled, optimized, bundled with libraries, or difficult for decompilers to reconstruct perfectly. Here, all classes were successfully decompiled, and the small number of anomalies mostly affected Kotlin library code rather than indicating heavy anti-analysis behavior.

Final JAR Safety Verdict

Verdict: Use caution
Risk level: Moderate
Confidence: Moderate

Should I trust this JAR, and why? The scan does not show strong evidence of malware, credential theft, destructive behavior, persistence, or a Minecraft RAT. Most alerts are explained by bundled Kotlin and SpongePowered Mixin libraries, which are normal for a Forge mod. However, the addon’s own code includes an auto-updater that downloads releases, a process-launching file helper, a Pastebin reference in a command, and an unexplained socket-based command sender. Those features may be legitimate, but they create enough unresolved risk that this JAR should only be used if it came directly from the official developer source and ideally after testing it in a non-critical Minecraft installation.