File scan report
Verdict Suspicious
Is Obfuscated-
No antivirus engine detected the tiny JAR, but an unconfirmed sandbox mapping and minimal prevalence justify caution pending further validation.
Read the whole reasonShow less
Why Suspicious? The file was first observed on Oct 9, 2026 and has only one known submission.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 16d ago
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 64 antivirus engines that checked it flagged the file, including the major antivirus engines, and the sandbox produced no malware verdict. However, the run mapped possible process injection under without identifying a target, while the file is and two written children remain unclassified.
The strongest evidence is the absence of detections across 75 engines, including 17 major antivirus engines reporting no detection. One completed sandbox did not issue a malware verdict and showed no persistence or sample-attributed network contacts. It nevertheless mapped T1055, which can indicate process injection, but no injected process, target, or exact method was recorded. The JAR is only 921 bytes and from a single submitter, leaving little reputation history. Two written files it created also lack saved verdicts, and no complete contacted-host reputation check is available, so the behavioral uncertainty prevents an unequivocal benign assessment.
What We Detected
Malware-family intelligence and malware-specific YARA rules also produced no matches.
Threat Behavior
One sandbox run launched the JAR through Java and recorded ordinary Java usage files. The run mapped T1055, which can indicate process injection, but it identified neither an injected process nor a target, and it returned no malware verdict. No sample-attributed network contacts or persistence indicators were observed. Two written files have no saved verdicts, and a complete host-reputation cross-check is unavailable.
What To Do Now
Keep security software enabled and avoid running the file on a production system until its source and intended test purpose are verified. If execution is necessary, use an isolated analysis environment and inspect the JAR contents and written files.
Where this verdict could be wrong3 caveats
- The sandbox mapped possible process injection under T1055, although it did not identify an injected process, target, or technique.
- The file is and has only one submission, so reputation and prevalence are not yet established.
- Two written files it created lack saved verdicts, leaving their nature unresolved.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 64 antivirus engines that checked it flagged the file.
- The completed sandbox produced no malware verdict and recorded no persistence indicators.
- No malware-specific YARA rules or malware-family intelligence matched the sample.
- The file was first observed on Oct 9, 2026 and has only one known submission.
- A sandbox mapping indicated possible process injection, although no injected target or method was identified.
- Two files written during execution do not have saved classifications.
- No complete reputation check is available for contacted hosts.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 1spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as downloading a file, but no download was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
Obfuscated-Benign-Java-Test.jar
ef5f94b3601540cfc96e319101ab9af34e9094217a4a0e2c9983715e659a5573
Uploaded file
- 1
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
Test run
- 2
Files
Created or changed
- Evidence 3 of 4: Written fileSeen in the test run
7004
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\7004
Test run - Evidence 4 of 4: Written fileSeen in the test run
3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Test run - +1 more recorded observation
4 facts from the test run. See the full activity list.
Includes 12 mapped techniques, every process, file, registry and network entry and 2 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 9, 2026, 6:37 PM UTC
- SHA-256
ef5f94b3601540cfc96e319101ab9af34e9094217a4a0e2c9983715e659a5573- SHA-1
2aca03dc14b1e077399fc1db473f4c8fdf1818b9- MD5
815fec5df3f35ec2545d4065513f53fe
About this file
Obfuscated-Benign-Java-Test.jar is a JAR file of 921 B.
- Type and size
- JAR · 921 B
- Signer
- Not applicable
- First seen
- Oct 9, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Obfuscated-Benign-Java-Test.jar safe, or is it malware?
What is Obfuscated-Benign-Java-Test.jar?
How many antivirus engines detected Obfuscated-Benign-Java-Test.jar?
What should I do if I already opened or ran Obfuscated-Benign-Java-Test.jar?
What is the SHA-256 hash of Obfuscated-Benign-Java-Test.jar?
How up to date is this analysis of Obfuscated-Benign-Java-Test.jar?
Community
Member reviews and reports for this exact file hash.