File scan report
Verdict Safe
Is Anti
None of the 64 antivirus engines that checked it flagged this established JAR, and its completed sandbox run found no malicious verdict despite two unsupported behavioral mappings.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 5y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 64 antivirus engines that checked it flagged the file, including all 17 major antivirus engines represented in the results.
The strongest evidence is the absence of any detection among 74 engines, with no major or independent engine flags. A completed sandbox run returned clean and did not record network communication or persistence. It mapped and T1562.001, but no injected target was identified and the process list mainly reflects Java execution and analysis instrumentation. No malware-specific YARA rules, MalwareBazaar record, malicious child verdict, or named threat family corroborates those mappings. The five files it created lack saved verdicts, and no complete host-reputation cross-check is available, so those areas remain coverage limitations rather than adverse evidence.
What We Detected
None of the 64 antivirus engines that checked it flagged AntiAntiXray-1.8.jar, including the major antivirus engines represented in the results. No named malware family, malware-specific YARA rule, or MalwareBazaar record was found.
Threat Behavior
One completed sandbox run returned clean and recorded no sample network contacts or persistence indicators. It mapped T1055 and T1562.001, but no injected process, injection method, or concrete security-control disabling action was identified. The observed Java commands also include analysis instrumentation, which limits the weight of these broad mappings.
What To Do Now
The evidence supports normal use if the JAR came from the expected Minecraft server-plugin source. Keep security software enabled, retain a backup of the server, and test third-party plugins in a restricted environment before production deployment.
Where this verdict could be wrong3 caveats
- The sandbox mapped possible process injection and security-control impairment, although it identified neither an injected process nor a concrete disabling action.
- Five written or dropped files have no saved verdict, so their safety was not independently established.
- No complete contacted-host reputation cross-check is available, although the completed sandbox recorded no sample network contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 64 antivirus engines that checked it flagged the file.
- All 17 major antivirus engines represented in the results reported no detection.
- The completed sandbox run returned clean and recorded no sample network contacts or persistence.
- No malware-specific researcher rules or known malware-exchange record matched the hash.
- The file has been observed for more than five years across 68 submitting sources.
- The test run mapped possible process injection and security-control impairment without identifying a target or concrete disabling action.
- Five generated or dropped files do not have saved verdicts.
- A complete reputation check for contacted hosts is unavailable.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 3spawned processes
- 0network contacts
- 11filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1055· Process injection
- T1059· Runs commands
- T1074
- T1082· System recon
- T1105· Network file transfer
- T1106
- T1129· Loads modules
- T1202
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.003· Hides artifacts
Observed activity
Processes started
3Programs the file ran, with their command lines.
javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\sample.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"
Files
11Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\2324 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\7108 - Written
C:\cmdlinestart.log
Show all 11 entries for files
- Written
\Device\ConDrv\\Connect - Written
/proc/4457/coredump_filter - Written
/tmp/hsperfdata_root/4457 - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\3592 - Deleted
/tmp/hsperfdata_root/4457
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- bb5f80f68e32f60b4108…12eb2cNot checkedno saved verdict
- b7ecfb585e8f07f081d9…ad6880Not checkedno saved verdict
- 45d80ef3a9826a792984…fa95c7Not checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 11, 2026, 2:22 PM UTC
- SHA-256
2abf1c0a64e256f04134d5fd98cb9e8fc11becab26ac9477aabc169ea3669801- SHA-1
534dd237a8d953485f4a04ef19ef944aa36f35af- MD5
2ef21fbec654411bfae3ba70ef731d9b
About this file
AntiAntiXray-1.8.jar is a JAR file of 47.4 kB.
- Type and size
- JAR · 47.4 kB
- Signer
- Not applicable
- First seen
- Aug 30, 2021On VirusTotal.
- Submitted by
- 68 distinct sources
First scanned
Antivirus consensus
0 of 64 engines flagged this file
10 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is AntiAntiXray-1.8.jar safe?
What is AntiAntiXray-1.8.jar?
How many antivirus engines detected AntiAntiXray-1.8.jar?
What is the SHA-256 hash of AntiAntiXray-1.8.jar?
Is it safe to open or run AntiAntiXray-1.8.jar?
How up to date is this analysis of AntiAntiXray-1.8.jar?
Community
Member reviews and reports for this exact file hash.