File scan report
Verdict Safe
Is leaves
This Java archive was flagged by none of the 65 antivirus engines that checked it, and the sandbox runs recorded only ordinary Java activity in the test run with no high-risk…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
No malware indicators were found. If you use this tool, get it from its official project page and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The sandbox runs showed the Java runtime starting it, with no named injection targets and no network activity of its own. It appears to be a game hack client, which carries account-ban risk but shows no signs of malware.
None of the 65 antivirus engines that checked it flagged the file, and 17 major antivirus engines reported it clean. The sandbox runs recorded only Java runtime processes and routine temporary files. No high-risk techniques were seen. The only network contact was the analysis machine's own background traffic. The file has been seen from 18 sources over about ten weeks, and no public malware database lists it.
What We Detected
No antivirus engine out of 75 flagged this Java archive. Major antivirus engines such as Kaspersky, ESET, BitDefender and Microsoft returned clean results. No external malware databases or community rules matched it.
Threat Behavior
The sandbox runs show the Java runtime launching the archive and writing standard Java performance and usage files. No process injection target, persistence, or network traffic from the sample itself was recorded. A host-reputation check of contacts was not completed, but the only contact seen was the analysis machine's background traffic.
What To Do Now
The file name suggests a game modification or cheat client. Using it may violate a game's rules and lead to account bans. Download such tools only from the project's official source and keep your antivirus enabled.
Where this verdict could be wrong1 caveat
- The name points to a game cheat client, which may break a game's terms of service, although nothing in the evidence shows harmful behaviour.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 65 antivirus engines that checked it flagged the file
- Sandbox runs recorded only normal Java activity in the test run
- Seen from 18 different sources over about ten weeks
- No listing in public malware databases
- The file appears to be a game cheat client, which can violate game terms of service.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 15sandbox rule tags
- 3spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
Includes 15 mapped techniques, every process, file, registry and network entry and 3 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 8, 2026, 3:46 PM UTC
- SHA-256
5aab62df5d2b67f0e09929dcc166c3deca944afe337a3c488f97ad188aba3891- SHA-1
0fcb3e190c1667cfb234c452cfdba578dbe910e0- MD5
1f81dc711e73dd111c88e2f7b38ec302
About this file
leavesHack-2.3.0.jar is a JAR file of 1.8 MB.
- Type and size
- JAR · 1.8 MB
- Signer
- Not applicable
- First seen
- Aug 12, 2026On VirusTotal.
- Submitted by
- 18 distinct sources
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is leavesHack-2.3.0.jar safe?
What is leavesHack-2.3.0.jar?
How many antivirus engines detected leavesHack-2.3.0.jar?
What is the SHA-256 hash of leavesHack-2.3.0.jar?
Is it safe to open or run leavesHack-2.3.0.jar?
How up to date is this analysis of leavesHack-2.3.0.jar?
Community
Member reviews and reports for this exact file hash.