File scan report
Verdict Safe
Is AUTISM Client-
No antivirus engine flagged the JAR.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 58 flagged
- Flagged 0
- No detection 58
- No result 17
- Code signing Not applicable
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
0 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The file shows no engine detections and no external-intel hits. Sandbox activity includes MITRE techniques that can appear in both legitimate and malicious Java applications, but the sandbox itself did not classify the sample as malicious. Nine files it created were inspected and none were malicious. Medium prevalence and 31-day history provide additional context that the file is not newly introduced malware.
What We Detected
75 engines scanned the 18.9 MB JAR; none returned a malicious or suspicious result. Sandbox execution logged three MITRE techniques (T1055, T1543.002, T1562.001) and one direct-IP connection to 162.159.36.2, but the sandbox verdict remained clean.
Threat Behavior
The observed techniques can appear in legitimate Java tooling that modifies its own process or adjusts permissions. No persistence mechanisms, registry changes, or malicious files it created were found. Contacted-host reputation data is unavailable.
What To Do Now
Keep security software enabled. If the file originates from an untrusted source, run it in a controlled environment or request the original publisher to provide a hash match from their official distribution channel.
- Zero detections from 75 engines
- No malicious files it created
- Medium prevalence across 333 sources
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 15sandbox rule tags
- 3spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
15MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1055· Process injection
- T1059· Runs commands
- T1064
- T1074
- T1082· System recon
- T1105· Network file transfer
- T1106
- T1129· Loads modules
- T1202
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
Observed activity
Processes started
3Programs the file ran, with their command lines.
javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\download.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\download.jar"
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\2232 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6792 - Written
C:\cmdlinestart.log
Show all 15 entries for files
- Written
\Device\ConDrv\\Connect - Written
/proc/3541/coredump_filter - Written
/tmp/hsperfdata_root/3541 - Written
/var/log/auth.log.1.gz - Written
/var/log/dpkg.log.1.gz - Written
/var/log/kern.log.1.gz - Written
/var/log/syslog.1.gz - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\1612 - Deleted
/tmp/hsperfdata_root/3541
Sandbox background — not the file
13The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " - VM process
invoke-rc.d/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart - VM process
runlevel/sbin/runlevel
Show all 13 entries for sandbox background — not the file
- VM process
systemctl/usr/bin/systemctl systemctl --quiet is-enabled cups.service - VM process
ls/usr/bin/ls ls /etc/rc[S2345].d/S[0-9][0-9]cups - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-active cups.service - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- ff4683b048f5419d9b4e…0bfc32Not checkedno saved verdict
- 574c58bdab4a3bb3f61e…8251e9Not checkedno saved verdict
- b67bdd66cda5dfafa9a8…a03cbdNot checkedno saved verdict
Chapter 04
Technical details
None of the 58 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 3, 2026, 10:33 AM UTC
- SHA-256
aad781162fe57a9e582cae69d863d165ee08bce8300eeccbbe99aac34a2b4b45- SHA-1
aa4cba15f81349575633b0700c1e230e2fb78501- MD5
3be4c67271730c5b405bcc0e7d166050
About this file
AUTISM Client-4.4-26.2.jar is a JAR file of 18.9 MB.
- Type and size
- JAR · 18.9 MB
- Signer
- Not applicable
- First seen
- Aug 3, 2026On VirusTotal.
- Submitted by
- 333 distinct sources
First scanned
Antivirus consensus
0 of 58 engines flagged this file
17 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-112 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastNo result
- Avast-MobileClean
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is AUTISM Client-4.4-26.2.jar safe?
What is AUTISM Client-4.4-26.2.jar?
How many antivirus engines detected AUTISM Client-4.4-26.2.jar?
What is the SHA-256 hash of AUTISM Client-4.4-26.2.jar?
Is it safe to open or run AUTISM Client-4.4-26.2.jar?
How up to date is this analysis of AUTISM Client-4.4-26.2.jar?
Community
Member reviews and reports for this exact file hash.