File scan report
Verdict Safe
Is bazaar-
None of the 64 antivirus engines that checked it flagged this Java archive, and three sandbox runs completed with a clean result and no high-risk techniques recorded.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This archive shows no signs of malware. Use it only if it came from the official source, and keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 6d ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The combined sandbox verdict was clean, showed only techniques common in legitimate software, and recorded no network activity of the file's own. The file is new, so stay alert to later updates.
All 18 major antivirus engines that reported marked it clean. The only network contact was the analysis machine's own background traffic. No public malware database or community rule lists the hash. The main limitation is the file's age: it was first seen on Oct 19, 2026 and has 11 submitters.
What We Detected
None of the 64 antivirus engines that checked it flagged this Java archive, including 18 major antivirus engines. No public malware database or community YARA rule lists it.
Threat Behavior
Three sandbox runs launched the archive with the Java runtime and returned clean. They recorded only techniques common in legitimate software, such as Java runtime housekeeping files. There was no persistence, no registry changes and no injected process. The single network contact belonged to the analysis machine's background activity.
What To Do Now
If you obtained this archive from the source you intended, it can be used. Because it is download it from the official project page and keep your security software enabled.
Where this verdict could be wrong2 caveats
- The file was first seen on Oct 19, 2026 with 11 submitters, so detection coverage for a new Java archive may still be catching up.
- Sandbox tags note debug-environment and CPU-name checks, which some malware uses for evasion, though ordinary Java runtimes and apps also trigger them.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 64 antivirus engines that checked it flagged the file.
- Three sandbox runs completed with a clean result and no high-risk techniques.
- No listing in public malware databases or matching malware rules.
- No persistence, registry changes or process injection were recorded.
- The file is new, first seen on Oct 19, 2026, with a modest number of submitters.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 16sandbox rule tags
- 6spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1055· Process injection
- T1059· Runs commands
- T1064
- T1074
- T1082· System recon
- T1105· Network file transfer
- T1106
- T1129· Loads modules
- T1202
- T1518.001· Checks your AV
- T1543.002· Service install
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
- T1574· Execution hijack
Observed activity
Processes started
6Programs the file ran, with their command lines.
javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -jar "C:\Users\user\Desktop\sample.jar""java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -jar "C:\Users\user\Desktop\sample.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -jar "C:\Users\user\Desktop\download.jar""java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -jar "C:\Users\user\Desktop\download.jar"java/usr/bin/java -jar /tmp/download.jar
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5880 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6380 - Written
\Device\ConDrv
Show all 15 entries for files
- Written
\Device\ConDrv\\Connect - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6892 - Written
/proc/3569/coredump_filter - Written
/tmp/hsperfdata_root/3569 - Written
/var/log/auth.log.1.gz - Written
/var/log/kern.log.1.gz - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\3360 - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\188 - Deleted
/tmp/hsperfdata_root/3569
Sandbox background — not the file
10The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " - VM process
invoke-rc.d/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart - VM process
runlevel/sbin/runlevel
Show all 10 entries for sandbox background — not the file
- VM process
systemctl/usr/bin/systemctl systemctl --quiet is-enabled cups.service - VM process
ls/usr/bin/ls ls /etc/rc[S2345].d/S[0-9][0-9]cups - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-active cups.service - VM host
a1672.dscr.akamai.net
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 9bef4e17da25f2d097a9…048357Not checkedno saved verdict
- c87ba0c3d4a90f90acc6…7bbab2Not checkedno saved verdict
- 12eb0af63f17c120d6ea…6a5956Not checkedno saved verdict
- 52e268fc16c584264679…09de55Not checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 22, 2026, 3:07 AM UTC
- SHA-256
9b4941b86042636045d8316589937536b54a1bad83a56895a6d2da6fd12eb10f- SHA-1
e253f05c3cccfbc65c68c67ac0051fcc21484505- MD5
d1e054a59e5051020e0caf78d9da1fda
About this file
bazaar-assist-0.1.42.jar is a JAR file of 179.9 kB.
- Type and size
- JAR · 179.9 kB
- Signer
- Not applicable
- First seen
- Oct 19, 2026On VirusTotal.
- Submitted by
- 11 distinct sources
First scanned
Antivirus consensus
0 of 64 engines flagged this file
11 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is bazaar-assist-0.1.42.jar safe?
What is bazaar-assist-0.1.42.jar?
How many antivirus engines detected bazaar-assist-0.1.42.jar?
What is the SHA-256 hash of bazaar-assist-0.1.42.jar?
Is it safe to open or run bazaar-assist-0.1.42.jar?
How up to date is this analysis of bazaar-assist-0.1.42.jar?
Community
Member reviews and reports for this exact file hash.