File scan report
Verdict Safe
Is m1mjnq51y.
No antivirus engine flagged this widely submitted JAR, while concerning sandbox technique mappings lack a malicious runtime verdict or independent threat corroboration.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Proceed only when the JAR came from a trusted, expected source; otherwise verify its publisher and checksum before execution. Keep antivirus protection enabled and avoid unnecessary administrator privileges.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 66 flagged
- Flagged 0
- No detection 66
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 66 antivirus engines that checked it flagged the file, including 17 major antivirus engines, and it has been submitted by 977 sources. One sandbox mapped several offensive techniques, but found no confirmed injection target, issued no malicious verdict, and contacted hosts with no cached threat matches.
The strongest evidence is the complete absence of detections among 75 engines, including no major alerts. The file also has broad recent prevalence, with 977 submitters and 1,181 submissions. However, those mappings came from one run, no injected process was identified, and the sandbox did not issue a malicious verdict. Host-reputation coverage included every distinct observed domain, IP address, and URL host and returned no malicious or suspicious matches. No malware-specific research rule, known malicious child, or named family independently corroborates the behavioral mappings.
What We Detected
None of the 66 antivirus engines that checked it flagged the JAR, and all 17 reporting major antivirus engines returned no detection. The file has also appeared across 977 sources and 1,181 submissions, indicating broad recent circulation rather than an isolated sample.
Threat Behavior
One sandbox run mapped T1003 credential dumping, T1055 process injection, T1543.002 service persistence, and T1562.001 security-control impairment. These mappings are concerning, but no injection target was recorded, no malicious sandbox verdict was produced, and the Java-related registry and process activity does not by itself establish hostile intent. The run contacted three distinct hosts; all were covered by the available reputation check, with no malicious or suspicious cache matches. Nine dropped files have no saved verdict and therefore remain unresolved rather than exonerated.
What To Do Now
Use the file only if it came from an expected source and its purpose is understood. Keep security software enabled, and avoid granting administrator privileges unless the application clearly requires them and the publisher can be verified.
Where this verdict could be wrong3 caveats
- The sandbox mapped credential access, process injection, service persistence, and security-control impairment techniques, although it did not identify an injection target or issue a malicious runtime verdict.
- The JAR contacted doomsday-themed domains and wrote a Java preferences key resembling a run-with-root setting; neither the hosts nor the activity received independent threat corroboration.
- Nine dropped files lack saved verdicts, so their nature remains unresolved despite no child being identified as malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 66 antivirus engines that checked it flagged the file, including all 17 reporting major antivirus engines.
- The file has broad recent prevalence across 977 submitters and 1,181 submissions.
- The reputation check covered all three observed hosts and found no cached malicious or suspicious matches.
- No malware-specific research rule, known malicious file it created, or named threat family corroborated the sandbox mappings.
- A sandbox mapped credential dumping, process injection, service persistence, and security-control impairment techniques.
- The file contacted doomsday-themed infrastructure and wrote a Java preferences entry resembling a persistence or elevated-run setting.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 23sandbox rule tags
- 3spawned processes
- 3network contacts
- 16filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
23MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1003· Credential theft
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1064
- T1071· Application protocol
- T1074
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1105· Network file transfer
- T1106
- T1129· Loads modules
- T1202
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562· Disables security
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
- T1568
Observed activity
Processes started
3Programs the file ran, with their command lines.
javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -jar "C:\Users\user\Desktop\download.jar""java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -jar "C:\Users\user\Desktop\download.jar"
Network contacts
33 hosts, listed as 1 domain, 1 address, 1 link. Links show the host and path only.
- Domain
doomsdayclient.xyz - IP address
165.22.196.0 - URL
http://doomsdayclient.com/download/version_manifest.csv
Files
16Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5400 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\7036 - Written
\Device\ConDrv
Show all 16 entries for files
- Written
\Device\ConDrv\\Connect - Written
/proc/3548/coredump_filter - Written
/root/.cache/dconf/user - Written
/root/.dbus/session-bus/a39eb3ed78b7401fb6809ed0c562a5b1-0 - Written
/root/.java/fonts/11.0.14/fcinfo4476873671142889417.tmp - Written
/tmp/hsperfdata_root/3548 - Written
/var/log/auth.log.1.gz - Written
/var/log/dpkg.log.1.gz - Written
/var/log/kern.log.1.gz - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\4148
Registry and auto-start
3Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\Software\JavaSoft\Prefs - Set
HKEY_CURRENT_USER\Software\JavaSoft\Prefs - Set
HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Prefs\is/Run/With/Root21
Sandbox background — not the file
12The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " - VM process
invoke-rc.d/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart - VM process
runlevel/sbin/runlevel
Show all 12 entries for sandbox background — not the file
- VM process
systemctl/usr/bin/systemctl systemctl --quiet is-enabled cups.service - VM process
ls/usr/bin/ls ls /etc/rc[S2345].d/S[0-9][0-9]cups - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-active cups.service - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- e897595173cd123ee4bc…fddea7Not checkedno saved verdict
- 64262ee67ce1812dd988…eafd9aNot checkedno saved verdict
- 57f5d8836cc1a74d3c54…60df00Not checkedno saved verdict
- 1bcbc71906aec34e57e0…dd6cf2Not checkedno saved verdict
Chapter 04
Technical details
None of the 66 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 12, 2026, 3:42 PM UTC
- SHA-256
bdcb9bd162125d9831878e8494046dfc9411a7625e4ca1772ba91b0f87aaae09- SHA-1
74109e9171c75c0f72c6cba1377421e2e9427a8b- MD5
4946f4cfb65568621b85d1bf7e2cf021
About this file
m1mjnq51y.jar is a JAR file of 3.1 MB.
- Type and size
- JAR · 3.1 MB
- Signer
- Not applicable
- First seen
- Sep 20, 2026On VirusTotal.
- Submitted by
- 977 distinct sources
First scanned
Antivirus consensus
0 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
EvidenceT1003 (sandbox MITRE mapping)
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is m1mjnq51y.jar safe?
What is m1mjnq51y.jar?
How many antivirus engines detected m1mjnq51y.jar?
What is the SHA-256 hash of m1mjnq51y.jar?
Is it safe to open or run m1mjnq51y.jar?
How up to date is this analysis of m1mjnq51y.jar?
Community
Member reviews and reports for this exact file hash.