File scan report
Verdict Suspicious
Is Zinc-
Ten of the 62 antivirus engines that checked it call this Java archive a generic trojan, one test run was rated malicious while another came back clean, and the archive contents…
Read the whole reasonShow less
Why Suspicious? 10 antivirus engines flag it and one sandbox test run rated it malicious while another found nothing.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
Only run this archive if you know and trust where it came from. Keep your antivirus protection enabled and do not add exclusions for it, and remove it if you cannot confirm its origin.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
10 of 62 flagged
- Flagged 10
- No detection 52
- No result 13
- Code signing Not applicable
- Test run Completed
- First seen 19d ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Several independent security vendors detect this Java application as a generic trojan, and one test environment rated it malicious while another returned clean. The detections carry no shared family name, no bad network contact or file it created was recorded, and nobody has looked inside the archive. The signals point both ways, so treat the file with caution.
Ten of the 62 antivirus engines that checked it flag this Java archive, but the strongest-looking cluster is misleading: BitDefender, Emsisoft, GData and MicroWorld-eScan all report the same GenericKD detection from a single shared scan engine. That leaves ESET-NOD32 with "Java/Agent.ZX" and Kaspersky with a rule-based Java trojan label as the genuinely separate major voices, and no two major antivirus engines agree on a named family. The behavioural evidence is split: the test environments produced both a malicious rating and a clean one, no process was actually named as injected, and the only rare technique mapped was recorded without the artefact that would back it up. Nothing corroborates the hostile run — the single host contacted is background data, no malicious host was matched, no malicious file was dropped, and the public malware databases and community rule sets returned no hits. What remains is a heavily protected Java application whose tags show debugger detection, CPU-name checks and process-name changes, which fits both a protected game utility and a generic trojan, so the file cannot be called clean and cannot be called confirmed malware either.
What We Detected
Ten of the 62 antivirus engines that checked it flagged this Java archive, six of them counting as independent voices. The largest group reports a generic "GenericKD" trojan, but those brands share one underlying scan engine, so they count once. ESET-NOD32 names it Java/Agent.ZX and Kaspersky returns a rule-based Java trojan label; both are serious vendors, yet neither names a family the other agrees with. The rest of the labels are generic buckets such as "Trojan:JAVA/Generic" and "jar.trojan.generic". More than fifty engines, including Microsoft, Fortinet, Avira, DrWeb and F-Secure, found nothing.
Threat Behavior
Across five test environments the file was rated malicious in one summary and clean in another, so the evidence from the test run does not settle the question. No process was named as an injection target, no registry persistence was recorded, no malicious host was contacted, and no malicious file was dropped. The single network contact observed is a Windows/Office data host belonging to the test machine, not the sample. The file does carry traits typical of protected software: it checks the CPU name, looks for debugging tools and renames its process. Those behaviours show up in obfuscated game utilities as often as in unwanted software. Our own static inspection of the archive contents was not available, so nobody has verified what classes it actually contains.
What To Do Now
Do not run the archive unless you obtained it from a source you trust and you know what the application is meant to do. If it is a game modification or utility, keep in mind that such files often need to be excluded from antivirus protection to work — do not disable your protection or add exclusions for it. Scan the file again after any update and delete it if you no longer need it.
Where this verdict could be wrong4 caveats
- 52 of the engines that analysed the file flagged nothing, including Microsoft, Fortinet, Avira, DrWeb, F-Secure and Ikarus, which argues against a well-known trojan.
- One of the sandbox runs came back clean, so the hostile sandbox verdict is not unanimous.
- Anti-debug and CPU-name checks are also routine in protected game mods and utility software, so those traits alone would not establish malicious intent.
- No public malware database, community rule set or known-bad host matched this file, and nothing malicious was dropped on the test machines.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Fifty-plus engines, including Microsoft, Fortinet, Avira and F-Secure, flagged nothing
- No malicious host was contacted and no malicious file was dropped during testing
- One test environment returned a clean result, so the hostile runtime verdict is not unanimous
- No public malware database or community rule set matched this file
- Ten engines, several of them well-known vendors, detect this archive as a generic Java trojan
- One test environment rated the file malicious, with a trojan label
- The file checks the CPU name, looks for debuggers and changes its process name — anti-analysis traits also used by unwanted software
- Nobody has inspected the archive contents, so its classes are unverified
- There is no publisher signature or known-software reference to confirm what the file is
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 16sandbox rule tags
- 4spawned processes
- 0network contacts
- 19filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.
Note: Checked which security software was installed on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as downloading a file, but no download was recorded.
Not confirmed: A sandbox rule tagged this run as creating a service; no new service was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
Zinc-1.21.4.jar
15662e15ce5349b30d46c90778ce2606f2b38cf3e3cdd3588423923cac34a89b
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
Test run - Evidence 3 of 5: ProcessSeen in the test run
cmd.exe
C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -jar "C:\Users\user\Desktop\sample.jar""
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
3660
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\3660
Test run - Evidence 5 of 5: Written fileSeen in the test run
3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 16 mapped techniques, every process, file, registry and network entry and 3 dropped files.
Show the technical evidenceChapter 04
Technical details
10 of the 62 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 10
- BitDefender (major engine)Trojan.GenericKD.81865430
- Emsisoft (major engine)Trojan.GenericKD.81865430 (B)
- ESET-NOD32 (major engine)Java/Agent.ZX trojan
- GData (major engine)Trojan.GenericKD.81865430
- Kaspersky (major engine)HEUR:Trojan.Java.Generic
- AlibabaTrojan:JAVA/Generic.6849d61c
- alibabacloudTrojan:Java/Generic.Gen
- ArcabitTrojan.Generic.D4E12AD6
File fingerprint
- Last analyzed
- Nov 6, 2026, 2:19 PM UTC
- SHA-256
15662e15ce5349b30d46c90778ce2606f2b38cf3e3cdd3588423923cac34a89b- SHA-1
a4108e55a73072d54616475403f24c8869817f2d- MD5
4ee60553ab0d87e89a8234f00ee1a610
About this file
Zinc-1.21.4.jar is a JAR file of 2.8 MB.
- Type and size
- JAR · 2.8 MB
- Signer
- Not applicable
- First seen
- Oct 18, 2026On VirusTotal.
- Submitted by
- 26 distinct sources
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Zinc-1.21.4.jar safe, or is it malware?
What is Zinc-1.21.4.jar?
How many antivirus engines detected Zinc-1.21.4.jar?
What should I do if I already opened or ran Zinc-1.21.4.jar?
What is the SHA-256 hash of Zinc-1.21.4.jar?
How up to date is this analysis of Zinc-1.21.4.jar?
Community
Member reviews and reports for this exact file hash.