Suspicious
Unsigned JDownloader installer shows mixed AV signals with process injection behavior but benign drops and no malicious runtime verdicts.
de8b2bdfc61d635853…5b502bd95eThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file matches a known legitimate installer for JDownloader, which uses install4j and extracts Java runtime components. Tier-1 detections are generic (FileRepMalware) common for recent files, outweighed by 14 clean tier-1 scans. Process injection (T1055) into svchost and LSASS heuristic are red flags but lack corroboration from sandbox verdicts or drops. Unsigned status and new age contribute to caution without strong malicious consensus.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1FamilyConsensus.family='filerepmalware' (2 engines: Avast/AVG)
triggeredHeuristics[0].rule='MalwareTips.Synth.ProcessInjection' fired=true severity=high evidence='svchost.exe -k LocalSystemNetworkRestricted -p'
behaviour.filesWritten includes 'i4jruntime.jar' 'flatlaf.jar' 'java.exe -version'
engines.tier1Malicious=3 vs tier1ReportedClean=14 (e.g., ESET-NOD32, Kaspersky, BitDefender undetected)
droppedChildren.hasMaliciousChild=false (10 unknown)
- 14 tier-1 engines clean (ESET, Kaspersky, etc.)
- Benign installer drops (install4j, JRE)
- No malicious sandbox verdict
- No malicious contacted hosts/children
- Filename matches legit JDownloader installer
- Unsigned executable
- Recent first submission (2 days)
- Process injection (T1055) into svchost
- LSASS-targeting heuristic
- 3 tier-1 malicious detections
- Generic 'FileRepMalware' labels
Treat as potentially risky due to heuristics and detections; obtain from trusted official source and scan thoroughly. Avoid if possible until more scans agree clean.
filerepmalware corroborated by 1 source
- VT (75 engines)filerepmalware
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\<USER>\AppData\Local\Temp\tmp11FA.exe
- C:\Users\<USER>\AppData\Local\install4j\t\i4j_nlog_1.log
- C:\Users\<USER>\AppData\Local\install4j\t\e4j4987.tmp_dir1778084974\i4jruntime.jar
- C:\Users\<USER>\AppData\Local\install4j\t\e4j4987.tmp_dir1778084974\i4jparams.conf
- C:\Users\<USER>\AppData\Local\install4j\t\e4j4987.tmp_dir1778084974\i4j_extf_2_69g5ss_14qfchv.png
- C:\Users\<USER>\AppData\Local\install4j\t\e4jtw29889004
- C:\Users\<USER>\AppData\Local\install4j\t\e4j4987.tmp_dir1778084974\jre.tar.gz
- C:\Program Files (x86)\JDownloader\i4j_writeperm_test
- C:\Program Files (x86)\JDownloader
- A9A48A31
- Global\OneSettingQueryMutex+compat+encapsulation
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- da63081db591b7346d44…129e67Never scannednever seen before
- 48a4a9a7ebca4f7b8840…9533ccNever scannednever seen before
- 71c44233dd548b0e5042…06ad15Never scannednever seen before
- d816710152ba53e1a1a5…9ddfdeNever scannednever seen before
- 231290d6ac51b2b5639f…ec68a9Never scannednever seen before
- 34833b22dff8186f7920…4af4cbNever scannednever seen before
- 073ed831ed3eadfd87f4…998093Never scannednever seen before
- 652479f4613baa3782ac…7df640Never scannednever seen before
- 88c0cddf6b8b3e28d548…fd495cNever scannednever seen before
- bedcce48ca63cc72b24b…323c5aNever scannednever seen before
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
EvidenceC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exe
9 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- JDownloader2Setup_windows-x86_v11_0_29.exe
- Size
- 83.12 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- de8b2bdfc61d63585329b8cfca2a012476b46387435410b995aeae5b502bd95e
- MD5
- d3b398a757b424f91e645985ade00516
- SHA-1
- c5997e6a28a46041180780eb52842b668a65e4e2
- PE imphash
- cebbab50025aad300d9290d50864f4ef
- First seen (VT)
- 5/6/2026, 4:28:13 AM
- Last analysis (VT)
- 5/8/2026, 7:36:02 AM
- First scan (MalwareTips)
- 5/8/2026, 7:33:43 AM
- Last scan (MalwareTips)
- 5/8/2026, 1:16:29 PM
- Community reputation
- -1flagged
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.