Safe
Unsigned Java research tool; 17 tier-1 engines silent; javaagent instrumentation and reverse-engineering filename pattern consistent with dynamic analysis.
e5d40123e79a888b36…ef6b26b3a2The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits a clean engine consensus: zero malicious detections, 17 tier-1 engines silent, no tier-1 family agreement. The filename pattern and heuristic trigger ('filename_research_tool') align with Java reverse-engineering tooling. Sandbox behaviour shows javaagent instrumentation (jartracer.jar) and Java process execution — hallmarks of dynamic analysis, not malware. The two offensive MITRE techniques (service modification, tool disabling) are consistent with sandbox-evasion detection in a research context. No external-intel hits, no malicious children, no malicious contacted hosts. Community feedback explicitly rates it clean. The unsigned status is typical for research tools.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
0/66 engines malicious; tier1Malicious=0; 17 tier-1 engines (Kaspersky, Microsoft, BitDefender, ESET-NOD32, Fortinet, Avira, Emsisoft, F-Secure, GData, Ikarus, DrWeb, Avast, AVG) all silent
filenameAnalysis.looksLikeResearchTool=true; triggeredHeuristics 'filename_research_tool' fired (info severity)
Behaviour: 2 offensive MITRE (T1543.002, T1562.001) but 9 ambient; javaagent instrumentation (jartracer.jar) in sandbox execution — reverse-engineering pattern, not malware
droppedChildren: 6 inspected, 0 malicious; no malicious contacted hosts; no external-intel hits (CIRCL, MalwareBazaar, YARAify all negative)
Community annotation: 'Verdict: Clean Score: 0/100'; prevalence medium (251 submitters, 283 submissions) — consistent with shared research tool
- Zero malicious detections across 66 engines; 17 tier-1 vendors silent
- Filename and heuristic pattern consistent with Java reverse-engineering tooling
- Javaagent instrumentation (jartracer.jar) indicates dynamic-analysis framework, not malware
- Medium prevalence (283 submissions, 251 sources) suggests legitimate community distribution
- Community annotation explicitly rates file as clean
This file is safe to use in a controlled reverse-engineering or dynamic-analysis environment. No quarantine or remediation is necessary.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5760
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
- C:\Users\user\AppData\Local\Temp\hsperfdata_user
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\6560
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\2240
- /tmp/hsperfdata_root/5008
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache.
- 19c8e6fcfaa08d93fad2…0726acNever scannednever seen before
- 5a6a533d0b3be4b15900…99cf58Never scannednever seen before
- 3f8096f14540c8e18e4e…ad10b8Never scannednever seen before
- d87c5f3cdfb5b7c0510e…1ade9eNever scannednever seen before
- 44a3bab2c338e3bca24c…d3b9e7Never scannednever seen before
- ac941ead01d5451a7a9f…253227Never scannednever seen before
0 detections across 75 engines
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- 22qq-cracked-1.jar
- Size
- 728.3 KB
- MIME type
- (unknown)
- Detected type
- JAR
- SHA-256
- e5d40123e79a888b36494bdd1e54052eddd7593b5e08405239a6f4ef6b26b3a2
- MD5
- da8249ed8d772589e8aa57f3c5b196c5
- SHA-1
- 24be9d2a27bb567e7829c742b6f74783ceeca426
- First seen (VT)
- 4/16/2026, 9:58:12 PM
- Last analysis (VT)
- 6/6/2026, 4:26:04 AM
- First scan (MalwareTips)
- 6/15/2026, 2:20:26 PM
- Last scan (MalwareTips)
- 6/15/2026, 2:20:26 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.