Safe
Minecraft Forge installer; 16 tier-1 engines silent; 5,958 submissions over 851 days; DirectIpC2 heuristic fired on legitimate CDN contact.
dbba1cd1bf34a4b821…fdcff15b76The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits a classic benign-software profile: zero malicious detections across 63 engines, with 16 tier-1 engines (Kaspersky, Microsoft, BitDefender, ESET-NOD32, Fortinet, Avira, Emsisoft, F-Secure, GData, DrWeb, Avast, AVG) all reporting clean. The filename and version string match Minecraft Forge's official release naming convention. Prevalence data (5,958 submissions, common_old classification, 851 days in circulation) confirms this is an established, widely-distributed software package. The DirectIpC2 heuristic fired because the installer contacted 9 external IPs (Microsoft CDN 13.107.* and Cloudflare 104.21.*, 172.67.*) without DNS queries — a pattern the heuristic flags as C2 evasion. However, this is consistent with legitimate installer resource delivery, not malware command-and-control. Behaviour analysis shows 2 offensive MITRE techniques (T1543.002, T1562.001) paired with 18 ambient techniques typical of Java installers; no malicious sandbox verdict was recorded, and all 10 dropped children are unknown (0 malicious). No external-intel hits, no malicious contacted hosts, no brand mismatch.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
0/63 engines malicious; tier1Malicious=0; 16 tier-1 engines (Kaspersky, Microsoft, BitDefender, ESET-NOD32, Fortinet, Avira, Emsisoft, F-Secure, GData, DrWeb, Avast, AVG) all silent
Filename 'forge-1.12.2-14.23.5.2859-installer.jar' matches Minecraft Forge official release naming; prevalence.classification='common_old' with 5,958 submissions across 3,476 sources over 851 days
triggeredHeuristics: DirectIpC2 fired but contacted IPs are Microsoft CDN (13.107.*) and Cloudflare (104.21.*, 172.67.*) — legitimate resource delivery, not C2 evasion
behaviour.offensiveTechniques=[T1543.002, T1562.001] paired with 18 ambient techniques; no malicious sandbox verdict; 0/10 dropped children malicious
No external-intel hits (yaraify=0, circl=false, malwareBazaar=false); no malicious contacted hosts; no brand mismatch
- 16 tier-1 antivirus engines (Kaspersky, Microsoft, BitDefender, ESET-NOD32, Fortinet, Avira, Emsisoft, F-Secure, GData, DrWeb, Avast, AVG) all report clean
- 5,958 submissions across 3,476 unique sources over 851 days — common_old prevalence classification indicates established, widely-trusted software
- Filename and version string match Minecraft Forge official release naming convention
- 0 malicious dropped children (10/10 unknown); no malicious sandbox verdict
- No external-intel hits (YARA, CIRCL, MalwareBazaar); no malicious contacted hosts in our URL cache
This file is safe. It is the legitimate Minecraft Forge mod loader installer. The DirectIpC2 heuristic alert is a false positive from legitimate CDN contact. Proceed with installation if obtained from the official Minecraft Forge website.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 104.21.58.163
- 13.107.226.70
- 172.67.161.211
- 13.107.246.67
- 13.107.213.38
- 51.79.83.165
- 13.107.213.60
- 13.107.246.38
- 169.254.169.254
- 13.107.246.60
- C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\2540
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
- C:\Users\<USER>\Desktop\download.jar.log
- C:\Users\<USER>\AppData\Local\Temp\imageio6750141799124413593.tmp
- C:\Program Files (x86)\AutoIt3\download.jar.log
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\1228
- C:\Users\user\AppData\Local\Temp\imageio111851870505822271.tmp
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\6712
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\1040
- C:\Users\user\AppData\Local\Temp\imageio1852599542505012653.tmp
- \BaseNamedObjects\Local\SM0:5172:304:WilStaging_02
- \BaseNamedObjects\Local\SM0:5172:120:WilError_03
- \BaseNamedObjects\Local\ZonesCacheCounterMutex
- \BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- 32a5ecc36ae3b1b2e55a…5fe244Never scannednever seen before
- eb5873b2bded079ae19d…5c85e0Never scannednever seen before
- 7e08aba1483fc3287dec…447400Never scannednever seen before
- 773e5ebec57b29afe249…65bf0fNever scannednever seen before
- 0357375f761308fe3523…6255bbNever scannednever seen before
- 8f791e91e71ab7edb8e4…d0e7cbNever scannednever seen before
- 5b856bde85b90d7025eb…e67ab9Never scannednever seen before
- 6d3b8114c1cb3397fde7…fd4631Never scannednever seen before
- 4d0874db12939dd2efb7…84bbc5Never scannednever seen before
- a75ace99842dd6472f3d…c64e03Never scannednever seen before
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 9 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence104.21.58.163 · 13.107.226.70 · 172.67.161.211
0 detections across 74 engines
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- forge-1.12.2-14.23.5.2859-installer.jar
- Size
- 4.46 MB
- MIME type
- (unknown)
- Detected type
- JAR
- SHA-256
- dbba1cd1bf34a4b82148bac50a6150f63ffcb2d5dc7d88a0508c27fdcff15b76
- MD5
- 6f430c36cb072b408756a37556974ef4
- SHA-1
- 6b3d5be8b58d5385fda9c4d285367f4cb6e697b2
- First seen (VT)
- 2/27/2024, 4:13:01 PM
- Last analysis (VT)
- 6/20/2026, 3:39:43 PM
- First scan (MalwareTips)
- 6/28/2026, 12:02:04 AM
- Last scan (MalwareTips)
- 6/28/2026, 12:02:04 AM
- Community reputation
- +1trusted
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.