File scan report
Verdict Safe
Is Poo
None of the 66 antivirus engines that checked it flagged this NeoForge Minecraft mod, and its sandbox run stayed clean with no network contacts or dropped files.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Treat this as a normal Minecraft mod provided it came from the mod's official download page; keep your antivirus protection enabled and take future updates from the same source rather than reupload mirrors.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 1d ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is a Java Minecraft mod archive for the NeoForge mod loader. Not one of the 66 antivirus engines that checked it flagged it, the one sandbox run returned a clean result with no outbound network traffic, and neither malware-specific community rules nor public sample databases have any record of it. Nothing in the evidence points to hostile code.
The file is a large Java archive named for a NeoForge Minecraft mod, first seen on Nov 5, 2026, and it produced no detections at all: 0 of the 66 antivirus engines that checked it flagged it, including 18 major antivirus engines such as Kaspersky, BitDefender, ESET-NOD32, Microsoft and Fortinet. The single sandbox run returned a clean result, started only a Java process to load the archive, recorded no injected processes, no persistence entries, no dropped executable children and no outbound domain or IP contacts. The behaviour mappings present are the ordinary kind — system information queries, installed-software discovery and temporary-directory handling — and none of the high-risk techniques were recorded with a real artefact behind them, which fits software that installs and launches a game modification. Public malware databases and malware-specific community rule sets returned no match, and there are no earlier verdicts on similar files to weigh against it. Antivirus silence is not proof on its own, so the contents of the archive were not inspected; that caveat is the only open question here, and every available signal still points to a benign game mod.
What We Detected
Nothing. The file is a 35 MB Java archive for the NeoForge mod loader, and none of the 66 antivirus engines that checked it returned a detection — not the generic rule labels, not the machine-learning classifiers, and none of the 18 major antivirus engines. The absence of even a single low-confidence flag on a file this size is a meaningful result.
Observations from the test run
The sandbox run returned a clean result. It launched the archive with the system Java runtime, wrote only temporary runtime files, and contacted no domains, IP addresses or URLs. No processes were injected, no start-up entries were created, no registry keys were set and no executables were dropped. The techniques our behaviour rules mapped are the everyday ones seen when Java software enumerates the system and prepares a temporary working directory; the high-risk techniques were not recorded with the artefacts they describe.
Reputation and Reference Data
There is no entry for this file in public malware sample databases, no malware-specific community rule matches, and no known-good reference entry either. The file was first seen on Nov 5, 2026 and has been submitted by six distinct sources, so its history is short but not singular. There are no earlier similar-file judgements and no staff-reviewed reports against this hash.
Threat Behavior
None observed.
What To Do Now
Keep the file if it came from the mod's official distribution page or a trusted mod host. As with any community modification, download updates from the same source rather than from reupload mirrors, and keep your antivirus and security software enabled. If a future version asks you to disable your security software before running, treat that as a red flag and do not use it.
Where this verdict could be wrong3 caveats
- The archive contents were never opened for a closer look, so anything the mod loads or downloads at play time would not have been visible in this evidence.
- One clean run in a sandbox cannot cover every game version or server configuration, even though nothing hostile appeared.
- The hosted-file cross-check for network destinations was not completed, so no host-reputation result exists — it simply was not needed here because the run recorded no outbound contacts.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0 of the 66 antivirus engines that checked it flagged the file, with all 18 major antivirus engines reporting it clean.
- The sandbox run returned a clean result: no network contacts, no dropped executables, no start-up entries and no process injection.
- No malware-specific community rules matched and the file is absent from public malware sample databases.
- The behaviour recorded was limited to the ordinary system-information and temporary-file activity seen when Java software starts up.
- First seen on Nov 5, 2026 and submitted by only a handful of sources, so there is very little long-term history to draw on.
- The archive contents were not opened and inspected, so code fetched or loaded at play time would be outside what this evidence covers.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 1 isolated test; no test environment rated what it did as risky.
Test run summary
Capture complete- 1isolated sandbox run
- 5sandbox rule tags
- 1spawned processes
- 0network contacts
- 7filesystem & mutex artifacts
Includes the sandbox verdicts, 5 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 66 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 6:50 AM UTC
- SHA-256
65601978e18a5f0234c43928926d06fbf909fbf91b0b0dfc4a921346df0d5c23- SHA-1
a5bd9b518f156814faad193327c86c8a3ce3c7a3- MD5
4b69ca1f8712b1fb096c9708ff1cca1e
About this file
PooPooWumboDoodyCraft-neoforge-1.21.1.jar is a JAR file of 35.0 MB.
- Type and size
- JAR · 35.0 MB
- Signer
- Not applicable
- First seen
- Nov 5, 2026On VirusTotal.
- Submitted by
- 6 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is PooPooWumboDoodyCraft-neoforge-1.21.1.jar safe?
What is PooPooWumboDoodyCraft-neoforge-1.21.1.jar?
How many antivirus engines detected PooPooWumboDoodyCraft-neoforge-1.21.1.jar?
What is the SHA-256 hash of PooPooWumboDoodyCraft-neoforge-1.21.1.jar?
Is it safe to open or run PooPooWumboDoodyCraft-neoforge-1.21.1.jar?
How up to date is this analysis of PooPooWumboDoodyCraft-neoforge-1.21.1.jar?
Community
Member reviews and reports for this exact file hash.