File scan report
Verdict Suspicious
Is orchard-
This Java archive was flagged by none of the 65 antivirus engines that checked it, but one sandbox run labelled it a trojan while another run judged it clean.
Read the whole reasonShow less
Why Suspicious? One sandbox test run rated it malicious while another found nothing; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't open or run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already opened or ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 9d ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 65 antivirus engines that checked it flagged this Java archive, and no threat-intelligence database lists it. Our sandbox runs disagree: one labelled it a trojan, another found it clean. Nothing in the recorded behaviour backs up the trojan label, so the evidence is not strong enough either way.
None of the 65 antivirus engines that checked it flagged the file, including all 18 major antivirus engines that returned a result. Across four sandbox runs, one returned a trojan verdict and another returned clean, so the runs do not agree. The recorded behaviour shows no high-risk techniques, no named injection targets, no persistence and no network activity beyond the analysis machine's background traffic. No malware-specific rules or public malware listings match the file. Because it was first seen on Oct 17, 2026 and has a modest number of submitters, the conflicting sandbox result cannot be confirmed or dismissed.
What We Detected
None of the 65 antivirus engines that checked it flagged this 10.9 MB Java archive. No malware databases or malware-specific rules match its hash. One sandbox run labelled it a trojan, while another run returned clean.
Threat Behavior
Across the runs, the archive started Java processes and wrote ordinary Java runtime files. Our analysis recorded no injection into other processes, no persistence and no network contacts of its own; the only contacts were the analysis machine's background traffic. Tags show it checks for debugging environments and the CPU name. Legitimate Java applications commonly do this, though evasive malware does it too. Our behaviour rules matched only a general process-injection label that had no injected process behind it.
What To Do Now
If this is a game mod or plugin, only run it if you downloaded it from the project's official page or a reputable mod repository. Keep your antivirus enabled, and rescan the file in a few days once more data is available.
Where this verdict could be wrong1 caveat
- One sandbox run labelled the file a trojan. Its tags note debugger-environment and CPU-name checks, which some malware uses to evade analysis. However, many Java mods and launchers do the same, and no other evidence backs that run.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 65 antivirus engines that checked it flagged the file
- Another sandbox run judged the file clean
- No match in public malware databases or malware-specific rule sets
- No injection, persistence or network activity of its own was recorded
- One sandbox run labelled the archive a trojan
- The file was first seen on Oct 17, 2026 and has a modest number of submitters
- It checks for debugging environments and the CPU name, which evasive software sometimes does
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 16sandbox rule tags
- 6spawned processes
- 0network contacts
- 19filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Hid files or windows on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Loaded extra code modules while running.
Note: Checked which security software was installed on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as downloading a file, but no download was recorded.
Not confirmed: A sandbox rule tagged this run as creating a service; no new service was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
orchard-1.21.11.jar
f551fa5b1a5570b7cf1180153a7f9772f78f4f1502b059db99eb56242676997b
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"
Test run - Evidence 3 of 5: ProcessSeen in the test run
cmd.exe
C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -jar "C:\Users\user\Desktop\runtime.jar""
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
6124
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\6124
Test run - Evidence 5 of 5: Written fileSeen in the test run
3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 16 mapped techniques, every process, file, registry and network entry and 4 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 18, 2026, 6:59 PM UTC
- SHA-256
f551fa5b1a5570b7cf1180153a7f9772f78f4f1502b059db99eb56242676997b- SHA-1
22ca75e1451ab1448056f525c4cb8b3cc9f0c117- MD5
1a2c17c008ce15158244ad78c56f7454
About this file
orchard-1.21.11.jar is a JAR file of 11.0 MB.
- Type and size
- JAR · 11.0 MB
- Signer
- Not applicable
- First seen
- Oct 17, 2026On VirusTotal.
- Submitted by
- 17 distinct sources
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is orchard-1.21.11.jar safe, or is it malware?
What is orchard-1.21.11.jar?
How many antivirus engines detected orchard-1.21.11.jar?
I already downloaded and opened or ran orchard-1.21.11.jar — what should I do?
What is the SHA-256 hash of orchard-1.21.11.jar?
How up to date is this analysis of orchard-1.21.11.jar?
Community
Member reviews and reports for this exact file hash.