File scan report
Verdict Safe
Is Fapcraft 1.
No antivirus engine flagged this widely submitted JAR, and its completed sandbox run produced no malicious verdict or sample-attributed network activity.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The evidence supports ordinary use when the file came from the intended mod source and the hash matches. Keep security protection enabled and do not grant unnecessary elevated privileges.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 64 antivirus engines that checked it flagged the file, including all 17 reporting major antivirus engines, while its 476-source history indicates established distribution. One completed sandbox run returned clean, although two offensive technique mappings and seven unclassified dropped files justify retaining normal caution.
The strongest evidence is the complete absence of detections: none of the 64 antivirus engines that checked it flagged the JAR, and no independent or major detector identified a family. It has also appeared from 476 sources across 514 submissions, making it established rather than rare. One completed the test run produced a clean sandbox result, and the sole observed domain was identified as analysis-environment background traffic. No malware-specific research rule, threat-feed match, or saved malicious child verdict provides contrary corroboration.
What We Detected
None of the 64 antivirus engines that checked it flagged the JAR, including all 17 reporting major antivirus engines. No engine family consensus, malware-specific YARA rule, or MalwareBazaar match was present. The file has an established history, with 476 sources and 514 submissions.
Threat Behavior
One completed sandbox run returned clean. It mapped T1543.002 and T1562.001, which can represent service manipulation and impairment of defenses, but recorded no persistence indicators, registry changes, or process injection. The only contacted domain was explicitly identified as background traffic from the analysis environment, not sample activity. Seven dropped files have no saved classifications, so they remain an evidence gap rather than confirmed threats.
What To Do Now
Use the file only if it came from the expected mod source and its SHA-256 matches 50012cc345e3ee5b2f4e69e880f2b0ef3f58efbc83d8bc5007b887a25b6e8cec. Keep security software enabled and avoid granting the JAR unnecessary administrator permissions.
Where this verdict could be wrong2 caveats
- The runtime mapping includes service manipulation and possible impairment of defenses, which are offensive techniques and warrant caution despite the absence of detections.
- Seven dropped files lack saved verdicts, so their safety was not established; this is an evidence gap rather than a finding against the parent file.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 64 antivirus engines that checked it flagged the file.
- All 17 reporting major antivirus engines returned no detection.
- The file has an established history across 476 sources and 514 submissions.
- The completed sandbox run returned clean.
- No malware-specific research rule or known-malware feed match was found.
- The test run mapped service manipulation and possible impairment of defenses.
- Seven dropped files do not have saved classifications, leaving their nature unconfirmed.
- The JAR has no applicable publisher-signature assurance.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 3spawned processes
- 0network contacts
- 14filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1064
- T1082· System recon
- T1106
- T1202
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
Observed activity
Processes started
3Programs the file ran, with their command lines.
java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\sample.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"
Files
14Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5608 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6480 - Written
C:\cmdlinestart.log
Show all 14 entries for files
- Written
\Device\ConDrv\\Connect - Written
/proc/5022/coredump_filter - Written
/tmp/hsperfdata_root/5022 - Written
/var/log/auth.log.1.gz - Written
/var/log/kern.log.1.gz - Written
/var/log/syslog.1.gz - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6520 - Deleted
/tmp/hsperfdata_root/5022
Sandbox background — not the file
13The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
sh/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " - VM process
invoke-rc.d/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart - VM process
runlevel/sbin/runlevel - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-enabled cups.service
Show all 13 entries for sandbox background — not the file
- VM process
ls/usr/bin/ls ls /etc/rc[S2345].d/S[0-9][0-9]cups - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-active cups.service - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service - VM host
bg.microsoft.map.fastly.net
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- a5360605d5daaa2cb560…baf8d9Not checkedno saved verdict
- b5c0c86af5c49316ed72…2008bcNot checkedno saved verdict
- d997d4c933c09d2ff0cc…22626cNot checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 13, 2026, 1:14 AM UTC
- SHA-256
50012cc345e3ee5b2f4e69e880f2b0ef3f58efbc83d8bc5007b887a25b6e8cec- SHA-1
bedf438dbb72b47f68bddda8fc5187d321745d42- MD5
4a85b48c043d928baa9e38e4b1cc7a2e
About this file
Fapcraft 1.12.2 v1.1 (steve skin chage).jar is a JAR file of 45.8 MB.
- Type and size
- JAR · 45.8 MB
- Signer
- Not applicable
- First seen
- Jan 8, 2026On VirusTotal.
- Submitted by
- 476 distinct sources
First scanned
Antivirus consensus
0 of 64 engines flagged this file
10 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Fapcraft 1.12.2 v1.1 (steve skin chage).jar safe?
What is Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
How many antivirus engines detected Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
What is the SHA-256 hash of Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
Is it safe to open or run Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
How up to date is this analysis of Fapcraft 1.12.2 v1.1 (steve skin chage).jar?
Community
Member reviews and reports for this exact file hash.