Safe
Unsigned Java JAR with no engine detections across 49 reporters; consistent with legitimate Fabric mod.
6357a67908ab352c7b…b94fe34645The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The sample exhibits a clean detection profile: zero malicious flags across all engine tiers, no tier-1 consensus on any threat family, and no external-intelligence corroboration of malice. The single offensive MITRE technique (T1543.002) is offset by four ambient techniques and the absence of a malicious sandbox verdict, suggesting normal Java runtime behaviour rather than adversarial activity. The file's prevalence (medium, 5 submitters) and lack of community warnings further support a benign classification. The unsigned status and new submission date (1 day) are typical for open-source projects distributed through community channels.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 0/49 malicious detections; tier1Malicious=0; tier1ReportedClean=8 (Avira, Emsisoft, ESET-NOD32, F-Secure, Fortinet, GData, Microsoft)
unsigned JAR, no signer history, no brand mismatch — filename 'voicechat-fabric-2.6.20+26.2.jar' consistent with Fabric mod naming convention
behaviour: 1 offensive technique (T1543.002) but 4 ambient techniques; no malicious sandbox verdict; 5/5 dropped children clean; no contacted malicious hosts
prevalence: medium (5 submitters, 6 submissions); no external-intel hits (CIRCL, MalwareBazaar, YARAify all negative)
no triggered heuristics; no similar-hash RAG; no community annotations or recent feedback
- Zero malicious detections across 49 antivirus engines
- Eight tier-1 vendors explicitly reported clean
- No malicious sandbox verdict despite process-level activity
- Filename and version consistent with legitimate Fabric mod ecosystem
- No external-intelligence corroboration of malice
This file is safe to use. It is a legitimate Java archive consistent with the Fabric modding ecosystem and shows no signs of malware across comprehensive antivirus scanning and sandbox analysis.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- /proc/3573/coredump_filter
- /tmp/hsperfdata_root/3573
- /var/log/auth.log.1.gz
- /var/log/dpkg.log.1.gz
- /var/log/kern.log.1.gz
- /tmp/hsperfdata_root/3573
Files this sample writes at runtime
This file drops 5 children at runtime. None are currently flagged malicious in our cache.
- d87c5f3cdfb5b7c0510e…1ade9eNever scannednever seen before
- 61625fd8b084f70f242d…55abd2Never scannednever seen before
- 50c82f36208ed8040447…2d7843Never scannednever seen before
- 8e8711854186c68e2368…4a3c7cNever scannednever seen before
- 759aafcfa2395ce1b800…2af0f7Never scannednever seen before
0 detections across 74 engines
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- voicechat-fabric-2.6.20+26.2.jar
- Size
- 5.31 MB
- MIME type
- (unknown)
- Detected type
- JAR
- SHA-256
- 6357a67908ab352c7b84dded72ac1a51f255028ef13f98dc109541b94fe34645
- MD5
- dca7ed23d7e890a13f42412a8995f40d
- SHA-1
- cdb67f7d187dc886c6010d4710f3d2025e5e16ac
- First seen (VT)
- 6/21/2026, 3:57:35 PM
- Last analysis (VT)
- 6/21/2026, 3:57:35 PM
- First scan (MalwareTips)
- 6/22/2026, 2:57:43 PM
- Last scan (MalwareTips)
- 6/22/2026, 2:57:43 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.