File scan report
Verdict Safe
Is Skyblocker Modpack-
None of the 50 antivirus engines that checked it flagged this ZIP, and the completed sandbox run produced no malicious verdict.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 50 flagged
- Flagged 0
- No detection 50
- No result 21
- Code signing Not applicable
- Test run Completed
- First seen 5mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The antivirus results are strongly reassuring: 0 of the 50 antivirus engines that checked it detected the archive, including no major detections. One completed sandbox run did not produce a malicious verdict, and no malicious child was identified among ten inspected extractions. However, the runtime record includes and a direct connection to 162.159.36.2. The host-reputation cross-check was not saved, so no complete reputation conclusion is available for that contact. Moreover, all ten child verdicts are unknown, which limits assurance about each bundled JAR. Overall, the evidence favors an ordinary modpack archive, with source verification still advisable.
What We Detected
The archive received 0 detections from 71 antivirus engines, with the absence of major detections and 12 major antivirus engines reporting no detection. External intelligence also returned the absence of community YARA matches, the absence of a MalwareBazaar listing, and the absence of a known-software database match.
Threat Behavior
One completed sandbox run produced no malicious sandbox verdict and no persistence indicators. It did record T1562.001 and a direct connection to 162.159.36.2. Because no contacted-host reputation result was saved, no complete host-reputation result is available for that IP. Ten extracted files were inspected without an identified malicious child, but all ten retain unknown child verdicts.
What To Do Now
Use the archive only if it came from the modpack project's official release page or another trusted distribution channel. Keep security software enabled, and verify the bundled mod names and versions before installing them into a game profile.
Where this verdict could be wrong2 caveats
- One of our behaviour rules fired for 162.159.36.2, but the missing contacted-host reputation result means the IP's reputation was not completely cross-checked.
- All 10 extracted children have unknown verdicts, so the absence of a known-malicious dropped file does not establish that every bundled JAR is benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/50 engines reported malicious or suspicious results.
- No major antivirus engines flagged it and 12 major antivirus engines reported it clean.
- No sandbox returned a malicious verdict.
- No dropped file is known to be malicious after 10 inspections.
- No community YARA rule matched and the hash is not listed in the MalwareBazaar malware database.
- The sandbox's offensive-technique list includes T1562.001.
- One of our behaviour rules fired for 162.159.36.2.
- The missing contacted-host reputation result leaves the observed IP without a complete reputation result.
- A count of 1 distinct submitter and a count of 1 submission provide limited reputation history.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 6sandbox rule tags
- 7spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1082· System recon
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1564.001· Hides artifacts
Observed activity
Processes started
7Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\servers.dat",#1unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\Skyblocker Modpack-3.5.19.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy" "C:\Users\user\Desktop\Skyblocker Modpack-3.5.19.zip"exo-open/usr/bin/exo-open exo-open "/tmp/Skyblocker Modpack-3.5.19.zip"exo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa "/tmp/Skyblocker Modpack-3.5.19.zip"
Show all 7 entries for processes started
7z/usr/lib/p7zip/7z l -slt -bd -y -- "/tmp/Skyblocker Modpack-3.5.19.zip"
Files
15Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\modrinth.index.json - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\Gamma-Utils-2.5.10+mc1.21.11.jar - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\ImmediatelyFast-Fabric-1.14.2+1.21.11.jar
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\RoughlyEnoughItems-21.11.814-fabric.jar - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\aaron-mod-3.0.0-beta.3+1.21.11.jar - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\architectury-19.0.1-fabric.jar - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\chatpatches-8.0-alpha.8+1.21.11-fabric.jar - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\cloth-config-21.11.153-fabric.jar - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\entityculling-fabric-1.10.1-mc1.21.11.jar - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\fabric-api-0.141.3+1.21.11.jar - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\fabric-language-kotlin-1.13.11+kotlin.2.3.21.jar - Written
C:\Users\user\AppData\Local\Temp\v4zlwnba.kpy\mods\ferritecore-8.2.0-fabric.jar
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 86c453a86139662e7756…bfeef5Not checkedno saved verdict
- 999db8e1705ea805dd0d…d289e9Not checkedno saved verdict
- 050379a562eaf9c62553…a186c2Not checkedno saved verdict
- fda228d7e0e915b0b174…68b08eNot checkedno saved verdict
- 58c55da18189c91a49f8…36cb19Not checkedno saved verdict
- bd634e73fec7c84b47bf…c92009Not checkedno saved verdict
- 92180b38d52a6afc9cdc…4db2e1Not checkedno saved verdict
- 1fa97dc3412ea64defd4…11d9f6Not checkedno saved verdict
- dac7a306d1d9dd7cea6a…5d56c6Not checkedno saved verdict
- 8a40c84e5ecde525acfb…f423c8Not checkedno saved verdict
Chapter 04
Technical details
None of the 50 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 8, 2026, 6:40 PM UTC
- SHA-256
655cf76f153ddb21c32f0339f489c75e39e914fef0ae62881bc8d5f8a4f7ec08- SHA-1
b91cdf43d8b42dd46bb6a3db608b26810871e284- MD5
7ca10eae9ed65cd4a8cc8093ccc0e773
About this file
Skyblocker Modpack-3.5.19.zip is a ZIP file of 47.4 MB.
- Type and size
- ZIP · 47.4 MB
- Signer
- Not applicable
- First seen
- May 8, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned Updated
Antivirus consensus
0 of 50 engines flagged this file
21 of the 71 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-112 engines0flagged
- Tier-228 engines0flagged
- Low-trust10 engines0flagged
View all 71 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacNo result
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastNo result
- Avast-MobileClean
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebNo result
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminNo result
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingNo result
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZonerClean
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Skyblocker Modpack-3.5.19.zip safe?
What is Skyblocker Modpack-3.5.19.zip?
How many antivirus engines detected Skyblocker Modpack-3.5.19.zip?
What is the SHA-256 hash of Skyblocker Modpack-3.5.19.zip?
Is it safe to open or extract Skyblocker Modpack-3.5.19.zip?
How up to date is this analysis of Skyblocker Modpack-3.5.19.zip?
Community
Member reviews and reports for this exact file hash.