File scan report

Verdict Safe

Analyzed Sep 7, 20261 month ago

Is donut-smp-mod-v3.jar safe? Yes, no threats found.

No antivirus engine flagged the JAR and sandbox showed no malicious verdict.

Moderate evidence · No engine flags it, but no publisher signature confirms who made it.

Open or run it as usual if it came from the official source

The file shows no malicious indicators; keep protection enabled and download only from trusted sources.

Good practice2 tips

We found nothing harmful in this file.

Run it only if it came from the project's own website.
Keep your security software and system updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

0 of 59 flagged

Flagged 0
No detection 59
No result 16

Filedonut-smp-mod-v3.jar12.7 kBSHA-256 dc6b6cc2e39e…31e4ab

Code signing Not applicable
Test run Completed
First seen 7mo ago

None of the 59 antivirus engines that checked it flag it.

Chapter 02

Why we think so

0 points against it and 3 in its favour, checked against the scan evidence.

Analyst conclusion

Zero detections across 75 engines, including 12 major clean reports. Sandbox observed two MITRE techniques but returned no malicious verdict and no malicious files it created.

Where this verdict could be wrong1 caveat

contactedHosts is null — host-reputation cross-check was not completed or not saved.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 not needed or not applicable. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

11sandbox rule tags
5spawned processes
0network contacts
21filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

11

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1036
T1064
T1082· System recon
T1106
T1202
T1518.001· Checks your AV
T1543.002· Service install
T1562.001· Disables security
T1564· Hides artifacts
T1564.001· Hides artifacts
T1564.003· Hides artifacts

Observed activity

Processes started

5

Programs the file ran, with their command lines.

java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"" >> C:\cmdlinestart.log 2>&1
java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"
WidgetService.exe"C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.2.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
java/usr/bin/java -jar /tmp/sample.jar

Files

21

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\6888
WrittenC:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
WrittenC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
WrittenC:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed
WrittenC:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\82c61649-5cff-4624-88e4-4f342c41146b.dat
WrittenC:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\82c61649-5cff-4624-88e4-4f342c41146b.dat.~tmp

Show all 21 entries

WrittenC:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\82c61649-5cff-4624-88e4-4f342c41146b.dat~RF4c1ac9.TMP
WrittenC:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\82c61649-5cff-4624-88e4-4f342c41146b.dat~RF4c1ef0.TMP
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user
WrittenC:\Users\user\AppData\Local\Temp\hsperfdata_user\3864
WrittenC:\cmdlinestart.log
Written\Device\ConDrv\\Connect
Written/proc/4991/coredump_filter
Written/tmp/hsperfdata_root/4991
Written/var/log/auth.log.1.gz
DeletedC:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed
DeletedC:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\82c61649-5cff-4624-88e4-4f342c41146b.dat
DeletedC:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\82c61649-5cff-4624-88e4-4f342c41146b.dat~RF4c1ac9.TMP
DeletedC:\Users\user\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\LocalState\FeedSessions\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets!!com.msn.desktopfeed\82c61649-5cff-4624-88e4-4f342c41146b.dat~RF4c1ef0.TMP
DeletedC:\Users\user\AppData\Local\Temp\hsperfdata_user\2560
Deleted/tmp/hsperfdata_root/4991

Sandbox background — not the file

7

The analysis machine's own processes and connections, recorded in every run.

VM processicacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
VM processconhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
VM processsh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
VM processrsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate
VM processsystemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service
VM processgzip/bin/gzip

Show all 7 entries

VM processsh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/mail.info/var/log/mail.warn/var/log/mail.err/var/log/mail.log/var/log/daemon.log/var/log/kern.log/var/log/auth.log/var/log/user.log/var/log/lpr.log/var/log/cron.log/var/log/debug/var/log/messages

Dropped payload

Files this sample writes at runtime

This file drops 2 children at runtime. None are currently flagged malicious in our cache. 2 have no saved verdict and were not checked; that is missing coverage, not a finding.

2 not checked

feff7f7f889d2dda0b15…0a5830Not checked
no saved verdict
cac28300570425539746…009247Not checked
no saved verdict

Chapter 04

Technical details

None of the 59 antivirus engines that checked it flag it.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 59 engines flagged it · 16 gave no result DetailsSep 2, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsSep 7, 2026

Contacted hostsMalwareTips URL scannerNot neededThe sandbox recorded no contacted hosts to check

Signature rulesYARAify community rules + MalwareTips rulesCompleteNo rule matchedSep 7, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedSep 7, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchSep 7, 2026

File fingerprint

Last analyzed: Sep 7, 2026, 1:38 AM UTC

SHA-256: dc6b6cc2e39e6c64989bd7ff78ebf40f53402860167353a3d3c2e9ddf031e4ab
SHA-1: f606696bbeb5b888045409ea856766681f513ddd
MD5: 2cab41586bb2405a07ae75a08657f58b

About this file

donut-smp-mod-v3.jar is a JAR file of 12.7 kB.

Type and size: JAR · 12.7 kB
Signer: Not applicable
First seen: Mar 11, 2026On VirusTotal.
Submitted by: 7 distinct sourcesRarely seen: few people have submitted this exact file.

First scanned Sep 7, 2026

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is donut-smp-mod-v3.jar safe?

We found nothing harmful in donut-smp-mod-v3.jar. None of the 59 antivirus engines that checked it flag it. Run it only if it came from the project's own website.

What is donut-smp-mod-v3.jar?

donut-smp-mod-v3.jar is a Java program (JAR), about 12.7 kB. VirusTotal first saw it on Mar 11, 2026.

How many antivirus engines detected donut-smp-mod-v3.jar?

None of the 59 antivirus engines that checked it flag donut-smp-mod-v3.jar. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

What is the SHA-256 hash of donut-smp-mod-v3.jar?

The SHA-256 fingerprint of donut-smp-mod-v3.jar is dc6b6cc2e39e6c64989bd7ff78ebf40f53402860167353a3d3c2e9ddf031e4ab, and its MD5 is 2cab41586bb2405a07ae75a08657f58b. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to open or run donut-smp-mod-v3.jar?

We found nothing harmful in donut-smp-mod-v3.jar. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of donut-smp-mod-v3.jar?

This report reflects the scan on Sep 7, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Is donut-smp-mod-v3.jar safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Files

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

0 of 59 engines flagged this file

How widely this file has been seen

Questions & answers

Community

Is donut-smp-mod-v3.jar safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Files

Sandbox background — not the file

File fingerprint

About this file

Related file reports