The scanner answers one question about a file you are about to run: is this a bad idea? It reads the jar statically. Nothing in it is executed, no class is loaded, and no URL inside it is fetched — a scanner that has to run malware to find it is a scanner that runs malware.
Using it
- Open the Scanner page and drop a jar on it, or drag a jar anywhere onto the launcher window.
- The scan reports as it goes: the archive is read, class files are parsed, strings are collected, rules are matched, and the result is scored.
- The report opens on the verdict, the score and the findings that produced it. Every point is traceable to a rule and to the exact string that fired it.
- Past scans are kept with their hash and score, so a second copy of the same file can be compared against the first.
What the score means
| Score | Reading |
|---|---|
| 0 | No meaningful indicators. Reserved for a jar whose content matches known-good software, not merely for one that looks quiet. |
| 1–19 | Minor suspicious characteristics and nothing more. |
| 20–39 | Some behaviour worth a second look, often legitimate. |
| 40–59 | Several suspicious indicators, or one dangerous capability. Read the findings before running it. |
| 60–79 | Strong evidence of malicious behaviour. |
| 80–99 | Numerous serious indicators. Treat as hostile. |
| 100 | Overwhelming, well-supported evidence. Reserved for the worst of the worst. |
The same jar produces the same score every time, because the number is computed from the findings by a fixed rule set. It is never random and it is never based on the filename: a rule fires on what is in the class files, and the report shows what fired.
What it looks for
| Area | Examples |
|---|---|
| Archive structure | Nested jars, executables hidden in resources, files whose content does not match their extension, unusual entry names |
| Command execution | Runtime.exec, ProcessBuilder, PowerShell and shell invocations, including when the command string is built at runtime |
| Network | Discord webhooks, Telegram bot endpoints, paste sites, raw sockets, hard-coded IP addresses |
| Credential access | Reading the launcher's own account store, browser profile paths, login data, session files |
| Surveillance | Clipboard reads, key logging patterns, screen capture APIs |
| Evasion | String obfuscation, reflective class loading, disabling security tooling, Unsafe, agents and instrumentation |
| Loaders and libraries | Recognised libraries are matched against their Maven coordinates and their version is checked against the patched release |
False positives, and how they are avoided
Legitimate mods use sockets, run commands and read files. A scanner that flags all of that is a scanner people learn to ignore. So:
- Ordinary HTTP clients, logging libraries and cryptography libraries are recognised as libraries, and library usage inside them does not contribute points.
- Networking alone is reported and not scored.
- Obfuscation alone is reported and not scored — plenty of release-quality mods are minimised.
- High severity needs correlation, not a single keyword: a webhook is much worse next to a session-file read than on its own.
- Known-good mods can be matched by name, id and hash, which is what an exemption look like in practice.
Families
When the evidence fits a known family of malware — a specific rat, stealer or cheat-and-stealer — the report names it with a confidence level and shows the evidence that led there. A generic package name that merely looks unusual is never labelled as a family, and a jar is never called SilentNet or anything else on the strength of one string.
What a clean result is not
Static analysis is evidence, not a guarantee. A clean score means nothing the scanner can see looks malicious; it cannot see behaviour that only appears at runtime, and it will not detect a backdoor that is served later by a remote server. For files from strangers, a clean scan is permission to be careful, not permission to stop.
Every scan gets a plain-language overview written on top of the same findings, so the first thing you read is a sentence rather than a table. It is a reading of the local analysis, not a replacement for it: the score and the evidence are decided on your machine, and the jar is never uploaded.