Suspicious
Unsigned Minecraft mod with anti-debug and obfuscation; tier-1 engines silent but FileScan flags evasion techniques.
0c5cfabb7d64aac865…5ccc4925bfThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits a classic benign-software profile: zero tier-1 malware detections, high prevalence (common_old classification), and no confirmed malicious children or C2 contact. However, the consistent SUSPICIOUS verdicts from FileScan.IO and the presence of anti-debug and obfuscation techniques create ambiguity. The offensive MITRE techniques (T1543.002, T1562.001) are ambient to Java runtime execution and Oracle Java privilege management, not indicative of malicious payload. The evasion indicators align with legitimate mod obfuscation rather than malware family behaviour. No tier-1 engine identified a malware family, and no sandbox malicious verdict was recorded.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.tier1Malicious=0; 17 tier-1 engines (Avast, BitDefender, Kaspersky, Microsoft, ESET-NOD32, Fortinet, Emsisoft, others) all undetected
prevalence.classification=common_old; 67,224 submissions across 3,742 sources; file age 905 days — consistent with established Minecraft mod
behaviour.offensiveTechniques=[T1543.002, T1562.001] are ambient to Java runtime privilege escalation for Oracle usage tracking, not malicious payload indicators
droppedChildren.hasMaliciousChild=false; 10 children inspected, all verdicts unknown, no malicious confirmed
communityComments: FileScan.IO flagged SUSPICIOUS (5 reports, 100% confidence) citing anti-debug, base64, obfuscation — consistent with legitimate mod evasion, not malware family
- All 17 tier-1 antivirus engines report clean (Avast, BitDefender, Kaspersky, Microsoft, ESET-NOD32, Fortinet, Emsisoft, others)
- High prevalence: 67,224 submissions across 3,742 sources; file age 905 days indicates established software
- No malicious children confirmed (10 dropped files inspected, all verdicts unknown)
- No contacted malicious hosts; no C2 beaconing detected
- Filename consistent with known Minecraft mod project (Fapcraft)
- Anti-debug and obfuscation techniques detected by FileScan.IO (5 independent analyses, 100% confidence)
- Unsigned JAR file with no publisher verification
- T1543.002 and T1562.001 MITRE techniques (though ambient to Java runtime)
- Base64 encoding and masquerade tags in FileScan analysis
Do not execute this file on production systems without further investigation. If obtained from an official Minecraft mod repository, the risk is lower; if from an untrusted source, isolate and scan with updated antivirus before use. The tier-1 engine consensus suggests low malware probability, but FileScan's consistent evasion flags warrant manual code review or sandboxing in an isolated environment.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5900
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
- C:\ProgramData\Oracle
- C:\ProgramData\Oracle\Java
- C:\ProgramData\Oracle\Java\.oracle_jre_usage
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\6936
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\6968
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\6724
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\6932
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\4604
- \Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- 70eadfeb928b0ba67392…c88651Never scannednever seen before
- e5f18c887d14a902f7bd…d7c326Never scannednever seen before
- c1de3a9376fdaef0ba6a…308b70Never scannednever seen before
- 45129bbb6010a26880e1…778371Never scannednever seen before
- 3f8096f14540c8e18e4e…ad10b8Never scannednever seen before
- c73e13f885532ae82bcd…5de2b9Never scannednever seen before
- e528f24efa987f28ac62…00f9e6Never scannednever seen before
- b468bf508c1b034631c5…457d6eNever scannednever seen before
- 8c6fbce70f6f9ec2cfa7…e3ab25Never scannednever seen before
- 0e50dbe64e16b3d646c5…49996fNever scannednever seen before
0 detections across 75 engines
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- Fapcraft.1.12.2.v1.1.jar
- Size
- 43.70 MB
- MIME type
- (unknown)
- Detected type
- JAR
- SHA-256
- 0c5cfabb7d64aac865fd6753375ddd856bed12e1ff8f1e0e4164fa5ccc4925bf
- MD5
- f5d9b40d51f4bd60e2bd30d30e4548a2
- SHA-1
- f53e08bbe16f25240af25793600e76ea854b731a
- First seen (VT)
- 1/6/2024, 6:19:38 PM
- Last analysis (VT)
- 6/29/2026, 6:02:45 PM
- First scan (MalwareTips)
- 6/30/2026, 1:03:30 AM
- Last scan (MalwareTips)
- 6/30/2026, 1:03:30 AM
- Community reputation
- +6trusted
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.