MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Suspicious

Unsigned JAR shows process-injection and direct-IP contact despite zero engine detections.

Trust score48Caution
BK-Client2.4.jar
27.2 MB
65dfc6f67a3c38ad81…9555b5733e
Antivirus engines
0 of 74 flagged
Code signing
Unsigned
Age
First seen 3 days ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

62%Confidence
Moderate
Reasoning

All 64 reporting engines returned clean, including 17 tier-1 engines, producing a strong negative signal. However the sandbox recorded three offensive MITRE techniques and triggered two high/medium heuristics for reflective injection and DNS-less C2. The JAR is unsigned, three days old, and has no prior similar-hash verdicts. These contradictory signals place the file in mixed-signals territory rather than clean or confirmed malicious.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.tier1Malicious=0 and engines.malicious=0 across 64 reporting engines

  2. behaviour.offensiveTechniques includes T1055 (Process Injection) and triggeredHeuristics[0].rule=MalwareTips.Synth.ProcessInjection

  3. behaviour.contactedIps=["162.159.36.2"] with zero contactedDomains — MalwareTips.Synth.DirectIpC2 fired

  4. signing.verified=false (unsigned) and prevalence.classification=medium

  5. droppedChildren.hasMaliciousChild=false and externalIntel.yaraify.ruleCount=0

Points in its favour
  • Zero malicious detections across 64 engines
  • 17 tier-1 engines reported clean
  • No malicious dropped children
  • No external intelligence hits
Points against
  • Process injection (T1055) observed in sandbox
  • Direct-IP contact without DNS resolution
  • Unsigned JAR with numeric version in filename
  • Three-day file age and medium prevalence
What to do

Treat as suspicious; isolate and monitor before any production use.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
15

Adversary techniques mapped to the MITRE ATT&CK framework.

T1055T1059T1064T1074T1082T1105T1106T1129T1202T1518.001T1543.002T1562.001T1564T1564.001T1564.003
Spawned processes
15
$(unnamed)
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"
$(unnamed)
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
$(unnamed)
C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\download.jar"" >> C:\cmdlinestart.log 2>&…
$(unnamed)
C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
$(unnamed)
"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\download.jar"
$(unnamed)
/bin/gzip
$(unnamed)
/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
$(unnamed)
/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart
+7 more processes captured.
Network activity
1
IP addresses1
  • 162.159.36.2
Filesystem & mutexes
14
Files written13
  • C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5320
  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
  • C:\Users\user\AppData\Local\Temp\hsperfdata_user
  • C:\Users\user\AppData\Local\Temp\hsperfdata_user\6820
+8 more
Files deleted1
  • /tmp/hsperfdata_root/3593
Dropped payload

Files this sample writes at runtime

This file drops 9 children at runtime. None are currently flagged malicious in our cache.

9 unseen
  • e62985d777e884110d6d…83830cNever scanned
    never seen before
  • b4c7432e9c77e74232cd…86d63aNever scanned
    never seen before
  • fb8ca83a9e7b787c90e3…6126b0Never scanned
    never seen before
  • b468bf508c1b034631c5…457d6eNever scanned
    never seen before
  • d87c5f3cdfb5b7c0510e…1ade9eNever scanned
    never seen before
  • 61625fd8b084f70f242d…55abd2Never scanned
    never seen before
  • 50c82f36208ed8040447…2d7843Never scanned
    never seen before
  • 8e8711854186c68e2368…4a3c7cNever scanned
    never seen before
  • 759aafcfa2395ce1b800…2af0f7Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

2 synthesis
MITRE ATT&CK profile
Defense evasion× 1C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • ProcessInjection
    T1055
    high

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"
  • DirectIpC2
    T1071
    medium

    Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    162.159.36.2
Antivirus engine breakdown

0 detections across 74 engines

0 malicious0 suspicious74 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-240 engines
0flag
Mainstream engines with mixed FP rates
Low-trust17 engines
0flag
Heuristic / generic-AI engines (high FP rate)
All 74 engines report this file as clean.
Hash 65dfc6f67a3c… cross-referenced against 74 AV engines via our AV network.
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
6
Moderate upload volume.
Total submissions
6
Includes repeat uploads by the same source.
First seen by VT
2d ago
Jul 6, 2026
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
7/6/2026, 3:17:18 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
7/6/2026, 3:17:18 PM
Scanned here
7/9/2026, 7:41:54 AM
File name
BK-Client2.4.jar
Size
27.18 MB
MIME type
(unknown)
Detected type
JAR
SHA-256
65dfc6f67a3c38ad81a8050ed5e0107babeb645e77e508e209efb19555b5733e
MD5
c98023c17e387d6a78599cc7583161da
SHA-1
d59b85996038976f59c2cf98bc5e5d6d9b05e935
First seen (VT)
7/6/2026, 3:17:18 PM
Last analysis (VT)
7/6/2026, 3:17:18 PM
First scan (MalwareTips)
7/9/2026, 7:41:54 AM
Last scan (MalwareTips)
7/9/2026, 7:41:54 AM
Behavior tags
jarsets-process-namedetect-debug-environmentchecks-cpu-name
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.