File scan report
Verdict Suspicious
Is Kral
DrWeb alone identified Java.Muldrop.52, while 74 of the 63 antivirus engines that checked it did not flag the archive and no independent intelligence corroborated the label.
Read the whole reasonShow less
Why Suspicious? One antivirus engine (Dr.Web) flags it; nothing else confirms it.
Limited evidence
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or extract it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or extracted it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 63 flagged
- Flagged 1
- No detection 62
- No result 12
- Code signing Not applicable
- Test run Not run
- First seen 1mo ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only DrWeb flagged this ZIP as Java.Muldrop.52, with no family consensus or external-intelligence support. Because the archive is and no the test run is available, the alert may be a false positive, but its contents should be verified before opening.
Fifteen major antivirus engines reported no detection, and no other engine corroborated the Muldrop family. Researcher-curated sources supplied no matching rules or known-malware record. However, the file is with only one submission, which limits reputation-based reassurance. No completed observation from the test run or complete contacted-host reputation result is available, so the archive's actual behavior remains unverified.
What We Detected
DrWeb was the only engine among 75 to flag the archive, identifying Java.Muldrop.52. The remaining engines did not corroborate that family, including 15 major antivirus engines such as Kaspersky, Microsoft, BitDefender, ESET-NOD32, and Avast.
Threat Behavior
No completed sandbox observation is available, so there is no evidence from the test run showing whether files inside the ZIP execute, drop additional components, or contact remote infrastructure. A complete contacted-host reputation result is also unavailable. Researcher-curated intelligence returned no matching YARA rules or known-malware records.
What To Do Now
Do not launch Java files, scripts, or executables from the archive until its source and contents are verified. Keep security software enabled, rescan after antivirus signatures update, and obtain a fresh copy from the official distribution channel if available.
Where this verdict could be wrong3 caveats
- DrWeb, a major antivirus engine, identified Java.Muldrop.52; although uncorroborated, this is more meaningful than a less reliable rule-based alert.
- The archive is zero days old with only one submission, leaving insufficient history to establish that the DrWeb detection is a false positive.
- The 5/5 prior safe similarHashes entries are filetype-only matches, so they establish little beyond the fact that other ZIP archives were benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1/63 engines reported a detection.
- Major antivirus engines do not agree on one malware family, with only one engine naming Muldrop.
- Fifteen major antivirus engines reported no detection.
- YARAify, MalwareBazaar, and CIRCL supplied no corroborating hit.
- No malicious file it created is reported.
- DrWeb detected Java.Muldrop.52.
- The archive is and has only one recorded submission.
- No completed the test run is available.
- No complete contacted-host reputation result is available.
- ZIP archives can conceal executable Java components or scripts.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
1 of the 63 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
- DrWeb (major engine)Java.Muldrop.52
File fingerprint
- Last analyzed
- Sep 11, 2026, 2:24 PM UTC
- SHA-256
2d969322d2ad43cb4c055a984d27aac1a1a9a0b5bf69f1e0cc7755f85e11cbdb- SHA-1
93a96c6bedec5c5318b56c883799254ab97f6204- MD5
0e8dcfd7454955279ebd29398642dfdd
About this file
KralSMP-CurseForge.zip is a ZIP file of 19.3 MB.
- Type and size
- ZIP · 19.3 MB
- Signer
- Not applicable
- First seen
- Sep 11, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is KralSMP-CurseForge.zip safe, or is it malware?
What is KralSMP-CurseForge.zip?
How many antivirus engines detected KralSMP-CurseForge.zip?
What should I do if I already opened or extracted KralSMP-CurseForge.zip?
What is the SHA-256 hash of KralSMP-CurseForge.zip?
How up to date is this analysis of KralSMP-CurseForge.zip?
Community
Member reviews and reports for this exact file hash.