File scan report
Verdict Safe
Is meteorist-
No antivirus engine detected this established JAR, and its substantial submission history outweighs two uncorroborated behavioral technique classifications.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
The evidence supports normal use when the JAR came from the intended project source. Keep security protection enabled and avoid granting unnecessary privileges.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 64 antivirus engines that checked it avoided flagging this JAR, including 17 major antivirus engines, despite hundreds of prior submissions. One sandbox mapped activity to two offensive MITRE techniques, but produced no malicious verdict, persistence indicator, malicious child, or network contact.
The strongest evidence is the complete absence of detections across 75 engines, with all 17 reporting major antivirus engines finding nothing actionable. The file is also well established, having appeared through 572 sources and 648 submissions over 226 days. A completed sandbox run did not issue a malicious verdict or record persistence, registry changes, or network contacts. It did map activity to and T1562.001, but those classifications lack corroboration from engines, external intelligence, or known-malicious files it created. The three written child hashes remain individually unresolved, so they provide neither positive nor negative confirmation.
What We Detected
None of the 64 antivirus engines that checked it flagged the JAR, including all 17 reporting major antivirus engines. The sample has also accumulated 648 submissions from 572 sources over 226 days, which provides meaningful exposure without corresponding detection growth. CIRCL, MalwareBazaar, and YARAify supplied no corroborating threat intelligence.
Threat Behavior
One completed sandbox run mapped activity to T1543.002 and T1562.001, but it did not produce a malicious sandbox verdict, persistence indicator, registry modification, or observed network contact. Three written child hashes were inspected without a malicious child finding, although each child's individual status remains unresolved. Because contactedHosts is unavailable, no independent host-reputation result exists; however, the sandbox contact lists themselves were empty.
What To Do Now
Use the JAR only if it came from the expected project or distribution channel, and keep security software enabled. If its source is uncertain, verify the SHA-256 hash and test it in an isolated environment before granting elevated permissions.
Where this verdict could be wrong3 caveats
- The sandbox's offensive-technique list contains and T1562.001, including service manipulation and impairment-of-defenses classifications.
- The dropped-file summary reports 3 unknown children, so their absence from the malicious count is not equivalent to confirmed benign status.
- No contacted-host reputation result was saved, although the sandbox recorded no contacted domains, IPs, or URLs; no complete host-reputation result is available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/64 engines reported malicious or suspicious results.
- All 17 reporting major antivirus engines were non-detecting.
- One sandbox produced no malicious verdict.
- No malicious file it created was identified among 3 inspected hashes.
- The sample has 648 submissions from 572 sources over 226 days.
- Sandbox mapping included and T1562.001.
- Three hashes for files it created have unknown individual verdicts.
- JAR signing was not applicable, leaving no publisher identity to verify.
- No completed contacted-host reputation cross-check is available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 6sandbox rule tags
- 4spawned processes
- 0network contacts
- 10filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1064
- T1082· System recon
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562.001· Disables security
- T1564.001· Hides artifacts
Observed activity
Processes started
4Programs the file ran, with their command lines.
java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\runtime.jar"java/usr/bin/java -jar /tmp/sample.jar
Files
10Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\6880 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\5880 - Written
C:\cmdlinestart.log - Written
\Device\ConDrv\\Connect
Show all 10 entries for files
- Written
/proc/5003/coredump_filter - Written
/tmp/hsperfdata_root/5003 - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6500 - Deleted
/tmp/hsperfdata_root/5003
Sandbox background — not the file
5The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/mail.info/var/log/mail.warn/var/log/mail.err/var/log/mail.log/var/log/daemon.log/var/log/kern.log/var/log/auth.log/var/log/user.log/var/log/lpr.log/var/log/cron.log/var/log/debug/var/log/messages - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- ab31380a6d6fb674e48e…15e845Not checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 8, 2026, 3:58 PM UTC
- SHA-256
f83fbd14d545f69d2ebe4be3055d9ddbff03466ff1998cf76f273db51e2ad7a4- SHA-1
d569d8fbe0a78759c9e011e274f293f23ff6eb06- MD5
e69cb219a163889b887462e159d5f776
About this file
meteorist-1.21.11-2.jar is a JAR file of 401.8 kB.
- Type and size
- JAR · 401.8 kB
- Signer
- Not applicable
- First seen
- Jan 25, 2026On VirusTotal.
- Submitted by
- 572 distinct sources
First scanned
Antivirus consensus
0 of 64 engines flagged this file
11 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-233 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is meteorist-1.21.11-2.jar safe?
What is meteorist-1.21.11-2.jar?
How many antivirus engines detected meteorist-1.21.11-2.jar?
What is the SHA-256 hash of meteorist-1.21.11-2.jar?
Is it safe to open or run meteorist-1.21.11-2.jar?
How up to date is this analysis of meteorist-1.21.11-2.jar?
Community
Member reviews and reports for this exact file hash.