File scan report
Verdict Safe
Is Fapcraft 1.
No antivirus engine flagged this widely submitted JAR, and its completed sandbox run produced no malicious verdict or sample-attributed network activity.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The evidence supports ordinary use when the file came from the intended mod source and the hash matches. Keep security protection enabled and do not grant unnecessary elevated privileges.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 64 antivirus engines that checked it flagged the file, including all 17 reporting major antivirus engines, while its 476-source history indicates established distribution. One completed sandbox run returned clean, although two offensive technique mappings and seven unclassified dropped files justify retaining normal caution.
The strongest evidence is the complete absence of detections: none of the 64 antivirus engines that checked it flagged the JAR, and no independent or major detector identified a family. It has also appeared from 476 sources across 514 submissions, making it established rather than rare. One completed the test run produced a clean sandbox result, and the sole observed domain was identified as analysis-environment background traffic. No malware-specific research rule, threat-feed match, or saved malicious child verdict provides contrary corroboration.
What We Detected
None of the 64 antivirus engines that checked it flagged the JAR, including all 17 reporting major antivirus engines. No engine family consensus, malware-specific YARA rule, or MalwareBazaar match was present. The file has an established history, with 476 sources and 514 submissions.
Threat Behavior
One completed sandbox run returned clean. It mapped T1543.002 and T1562.001, which can represent service manipulation and impairment of defenses, but recorded no persistence indicators, registry changes, or process injection. The only contacted domain was explicitly identified as background traffic from the analysis environment, not sample activity. Seven dropped files have no saved classifications, so they remain an evidence gap rather than confirmed threats.
What To Do Now
Use the file only if it came from the expected mod source and its SHA-256 matches 50012cc345e3ee5b2f4e69e880f2b0ef3f58efbc83d8bc5007b887a25b6e8cec. Keep security software enabled and avoid granting the JAR unnecessary administrator permissions.
Where this verdict could be wrong2 caveats
- The runtime mapping includes service manipulation and possible impairment of defenses, which are offensive techniques and warrant caution despite the absence of detections.
- Seven dropped files lack saved verdicts, so their safety was not established; this is an evidence gap rather than a finding against the parent file.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 64 antivirus engines that checked it flagged the file.
- All 17 reporting major antivirus engines returned no detection.
- The file has an established history across 476 sources and 514 submissions.
- The completed sandbox run returned clean.
- No malware-specific research rule or known-malware feed match was found.
- The test run mapped service manipulation and possible impairment of defenses.
- Seven dropped files do not have saved classifications, leaving their nature unconfirmed.
- The JAR has no applicable publisher-signature assurance.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 3spawned processes
- 0network contacts
- 14filesystem & mutex artifacts
Includes the sandbox verdicts, 11 mapped techniques, every process, file, registry and network entry and 3 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 13, 2026, 1:14 AM UTC
- SHA-256
50012cc345e3ee5b2f4e69e880f2b0ef3f58efbc83d8bc5007b887a25b6e8cec- SHA-1
bedf438dbb72b47f68bddda8fc5187d321745d42- MD5
4a85b48c043d928baa9e38e4b1cc7a2e
About this file
Fapcraft 1.12.2 v1.1 (steve skin chage).jar is a JAR file of 45.8 MB.
- Type and size
- JAR · 45.8 MB
- Signer
- Not applicable
- First seen
- Jan 8, 2026On VirusTotal.
- Submitted by
- 476 distinct sources
First scanned
Includes every engine result (74) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Fapcraft 1.12.2 v1.1 (steve skin chage).jar safe?
What is Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
How many antivirus engines detected Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
What is the SHA-256 hash of Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
Is it safe to open or run Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
How up to date is this analysis of Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
Community
Member reviews and reports for this exact file hash.