Safe
Unsigned Java JAR with zero malicious detections from 17 tier-1 engines; heuristic process-injection flag is false positive from normal Java runtime.
1852c0552dc62b5b0c…6aa686b7d7The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
This unsigned Java application shows zero malicious detections across 64 reporting engines, with 17 tier-1 vendors (BitDefender, Kaspersky, Microsoft, ESET-NOD32, Fortinet, Emsisoft, and others) all reporting it clean. The triggered heuristic for process injection is a false positive: Java applications routinely spawn child processes and manage memory in ways that generic heuristic engines misclassify as injection attacks. The file's anti-analysis tags (detect-debug-environment, checks-cpu-name) are common in legitimate Java tools protecting against reverse engineering. No malicious sandbox verdicts, no malicious contacted hosts, and no malicious dropped children (9 inspected, all unknown) further support a benign classification. The medium prevalence (21 submitters, 22 submissions) is consistent with a legitimate but niche Java utility.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
17/17 tier-1 engines undetected (Avast, BitDefender, Kaspersky, Microsoft, ESET-NOD32, Fortinet, Emsisoft, F-Secure, GData, Ikarus, Avira, AVG, DrWeb)
0/64 engines reporting malicious; tier1Malicious=0; onlyLowTrustFlagging=false
triggeredHeuristics: MalwareTips.Synth.ProcessInjection fired but evidence is normal Java runtime (javaw.exe -jar execution)
droppedChildren: 9 inspected, 0 malicious, hasMaliciousChild=false
prevalence.classification=medium (21 submitters, 22 submissions over 8 days) — consistent with legitimate but niche Java tool
- 17/17 tier-1 engines undetected
- 0 malicious detections across 64 engines
- No malicious contacted hosts
- No malicious dropped children (9 inspected)
- No malicious sandbox verdicts
This file is safe. The process-injection heuristic is a false positive from normal Java runtime behaviour. Proceed with confidence if the source is trusted.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\3400
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
- C:\Users\user\AppData\Local\Temp\hsperfdata_user
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\7148
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\5388
- /tmp/hsperfdata_root/3540
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache.
- abd3f272627e3cd5e7a9…65eba2Never scannednever seen before
- d668a6d98d0171811bb3…cd4cecNever scannednever seen before
- 8f1a2a45d8770e39c0ea…909b4aNever scannednever seen before
- c1de3a9376fdaef0ba6a…308b70Never scannednever seen before
- d87c5f3cdfb5b7c0510e…1ade9eNever scannednever seen before
- 61625fd8b084f70f242d…55abd2Never scannednever seen before
- 50c82f36208ed8040447…2d7843Never scannednever seen before
- 8e8711854186c68e2368…4a3c7cNever scannednever seen before
- 759aafcfa2395ce1b800…2af0f7Never scannednever seen before
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
0 detections across 73 engines
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- zerio-FuckedByRaiiinsAndRekt.jar
- Size
- 1.71 MB
- MIME type
- (unknown)
- Detected type
- JAR
- SHA-256
- 1852c0552dc62b5b0cd73f9ca6c7d077ee10831f1011a317bd9ded6aa686b7d7
- MD5
- 6b237470acd73e894a545df2a2d198c7
- SHA-1
- 995ca7b46e4d346f136e25ac35d30405056d0797
- First seen (VT)
- 6/22/2026, 8:47:53 AM
- Last analysis (VT)
- 6/22/2026, 8:47:53 AM
- First scan (MalwareTips)
- 6/30/2026, 3:57:54 PM
- Last scan (MalwareTips)
- 6/30/2026, 3:57:53 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.