File scan report
Verdict Safe
Is meteor-
One less reliable engine raised a generic alert, while broad prevalence, clean runtime findings, and silence from all major engines strongly indicate a false positive.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 7mo ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 66 antivirus engines that checked it flagged this JAR, using a generic label, while all major engines remained silent. It has appeared across 1,914 sources, and the combined sandbox verdict was clean without corroborated high-risk behaviour or harmful network reputation.
The only antivirus alert comes from MaxSecure and uses a generic trojan label rather than identifying a real malware family. None of the major engines flagged the file, leaving that alert without independent support. The file has substantial established prevalence, with 2,533 submissions from 1,914 sources since it was first seen on Mar 26, 2026. The combined sandbox verdict was clean and recorded no corroborated high-risk techniques or named injection targets. All observed hosts were covered by the reputation check, with none identified as malicious or suspicious, and no malicious file it created or malware-specific external rule was found.
What We Detected
Only 1 of the 66 antivirus engines that checked it flagged this Java archive. MaxSecure supplied a generic trojan label, while major engines including Microsoft, Kaspersky, ESET, BitDefender, and Avast did not flag it. No specific malware family was identified.
Threat Behavior
The combined sandbox verdict was clean. The reputation check covered every observed host and found none classified as malicious or suspicious.
What To Do Now
The isolated detection is strongly consistent with a false positive, particularly given the file's 2,533 submissions from 1,914 sources. Obtain the JAR from the project's official release channel, verify its checksum when one is published, and keep security software enabled.
Where this verdict could be wrong2 caveats
- MaxSecure reports a generic trojan detection, although no second engine corroborates it.
- The sandbox mapped T1562.001, but it recorded no supporting artefact and no named injection target, so the mapping does not establish defence tampering.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- All major antivirus engines remained silent; only one less reliable engine raised an alert.
- The file has 2,533 submissions from 1,914 distinct sources.
- The combined sandbox verdict was clean without corroborated high-risk behaviour.
- Every observed host was checked, and none was identified as malicious or suspicious.
- No malicious dropped file, malware-specific community rule, or public malware-database listing was found.
- MaxSecure labels the file with a generic trojan detection.
- A sandbox technique mapping suggested possible defence-related activity, but no supporting artefact was recorded.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 10sandbox rule tags
- 4spawned processes
- 1network contact
- 13filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1064
- T1082· System recon
- T1106
- T1202
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
Observed activity
Processes started
4Programs the file ran, with their command lines.
java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"java/usr/bin/java -jar /tmp/download.jar
Network contacts
11 host, listed as 1 domain. Links show the host and path only.
- Domain
edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com
Files
13Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5648 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\2376 - Written
C:\cmdlinestart.log
Show all 13 entries for files
- Written
\Device\ConDrv\\Connect - Written
/proc/5001/coredump_filter - Written
/tmp/hsperfdata_root/5001 - Written
/var/log/auth.log.1.gz - Written
/var/log/kern.log.1.gz - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\2268 - Deleted
/tmp/hsperfdata_root/5001
Sandbox background — not the file
11The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service - VM process
gzip/bin/gzip
Show all 11 entries for sandbox background — not the file
- VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/mail.info/var/log/mail.warn/var/log/mail.err/var/log/mail.log/var/log/daemon.log/var/log/kern.log/var/log/auth.log/var/log/user.log/var/log/lpr.log/var/log/cron.log/var/log/debug/var/log/messages - VM host
a1672.dscr.akamai.net - VM host
eip-terr-na.cdp1.digicert.com.akahost.net - VM host
nexusrules.officeapps.live.com - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 7f17ec76a1c3ccdef001…b37e0aNot checkedno saved verdict
- c1f2778024e96d9f8f81…4cc280Not checkedno saved verdict
Chapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
File fingerprint
- Last analyzed
- Oct 24, 2026, 1:47 PM UTC
- SHA-256
7aa5e6c22664eeea6f2927727c82c67206c29495eebbb2e3c29e8c134278d94f- SHA-1
c7d34cebe255d86d95633d2d7bbe5c6afc8785fe- MD5
068690162dce9380c03eb67d38124a3f
About this file
meteor-rejects-addon-0.3.jar is a JAR file of 3.2 MB.
- Type and size
- JAR · 3.2 MB
- Signer
- Not applicable
- First seen
- Mar 26, 2026On VirusTotal.
- Submitted by
- 1,914 distinct sources
First scanned Updated
Antivirus consensus
1 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust13 engines1flagged
View all 75 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is meteor-rejects-addon-0.3.jar safe?
What is meteor-rejects-addon-0.3.jar?
How many antivirus engines detected meteor-rejects-addon-0.3.jar?
What is the SHA-256 hash of meteor-rejects-addon-0.3.jar?
Is it safe to open or run meteor-rejects-addon-0.3.jar?
How up to date is this analysis of meteor-rejects-addon-0.3.jar?
Community
Member reviews and reports for this exact file hash.