File scan report
Verdict Safe
Is shoreline-
This Java add-on archive was flagged by none of the 64 antivirus engines that checked it, and the combined sandbox verdict was clean with no high-risk behaviour.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This add-on appears clean based on the available evidence. Obtain it only from the project's official distribution channel and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 21d ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Four sandbox runs only showed the Java runtime starting normally, with no injection target, no contact beyond the analysis machine's own background traffic, and no hits in malware databases.
None of the 64 antivirus engines that checked it flagged the file, and the 18 major engines that analysed it all reported it clean. The combined sandbox verdict was clean, and no high-risk techniques were recorded. The only network contacts were the analysis machine's own background traffic, and reputation checks on them were clean. Public malware databases and community rule sets had no matches. The file is unsigned and rarely submitted, which limits provenance but adds no hostile evidence.
What We Detected
This Java archive, apparently a game add-on build first seen on Oct 4, 2026, was flagged by none of the 64 antivirus engines that checked it. All 18 major engines that analysed it reported it clean. Public malware databases and community detection rules returned no matches.
Threat Behavior
The combined sandbox verdict was clean. Only the Java runtime was observed starting, plus routine Java usage and performance files being written. The only network traffic came from the analysis machine itself.
What To Do Now
The evidence does not indicate a threat. The file is unsigned and has few submitters, so download add-ons only from the project's official page or a trusted mod repository, and keep your antivirus enabled.
Where this verdict could be wrong2 caveats
- The file is a rarely submitted, unsigned Java add-on first seen on Oct 4, 2026, so there is little publisher or community history to confirm its origin.
- Sandbox tags note debug-environment and CPU-name checks, which some malware uses to evade analysis, though such checks are also common in ordinary Java runtimes and mod loaders.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 64 antivirus engines that checked it flagged the file, including 18 major engines that reported it clean.
- The combined sandbox verdict was clean with no high-risk techniques.
- No matches in public malware databases or community detection rules.
- Network contacts were limited to the analysis machine's own background traffic.
- Java archive with few submitters, so its origin cannot be confirmed from publisher history.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 16sandbox rule tags
- 4spawned processes
- 0network contacts
- 12filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1055· Process injection
- T1059· Runs commands
- T1064
- T1074
- T1082· System recon
- T1105· Network file transfer
- T1106
- T1129· Loads modules
- T1202
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
Observed activity
Processes started
4Programs the file ran, with their command lines.
javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"java/usr/bin/java -jar /tmp/runtime.jar
Files
12Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5176 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6612 - Written
C:\cmdlinestart.log
Show all 12 entries for files
- Written
\Device\ConDrv\\Connect - Written
/proc/3556/coredump_filter - Written
/tmp/hsperfdata_root/3556 - Written
/var/log/auth.log.1.gz - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\5704 - Deleted
/tmp/hsperfdata_root/3556
Sandbox background — not the file
13The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
sh/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " - VM process
invoke-rc.d/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart - VM process
runlevel/sbin/runlevel - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-enabled cups.service
Show all 13 entries for sandbox background — not the file
- VM process
ls/usr/bin/ls ls /etc/rc[S2345].d/S[0-9][0-9]cups - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-active cups.service - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM host
atm.teams.mira.tm.svc.cloud.microsoft - VM host
assets.msn.com
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- db2a10c64e133f256d14…729749Not checkedno saved verdict
- bb40a61a791be87fa823…f79aeeNot checkedno saved verdict
- cf3496dfea09ed73884b…c4dae7Not checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 24, 2026, 3:25 PM UTC
- SHA-256
6786d7fc200a6494e66b5047e8e44526fa30f3b5e7e598e60524dd48fd6182d6- SHA-1
8bf2921fa5a22bb9fdefdc95c3a14b7146d19fa1- MD5
da5160e7f0fe77a50a07d14d904d2e61
About this file
shoreline-addon-v1.0_nightly-b12-36a636b_1.21.11.jar is a JAR file of 620.8 kB.
- Type and size
- JAR · 620.8 kB
- Signer
- Not applicable
- First seen
- Oct 4, 2026On VirusTotal.
- Submitted by
- 6 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 64 engines flagged this file
11 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is shoreline-addon-v1.0_nightly-b12-36a636b_1.21.11.jar safe?
What is shoreline-addon-v1.0_nightly-b12-36a636b_1.21.11.jar?
How many antivirus engines detected shoreline-addon-v1.0_nightly-b12-36a636b_1.21.11.jar?
What is the SHA-256 hash of shoreline-addon-v1.0_nightly-b12-36a636b_1.21.11.jar?
Is it safe to open or run shoreline-addon-v1.0_nightly-b12-36a636b_1.21.11.jar?
How up to date is this analysis of shoreline-addon-v1.0_nightly-b12-36a636b_1.21.11.jar?
Community
Member reviews and reports for this exact file hash.