Archive validation
Validates ZIP/JAR structure, rejects path traversal, caps entry counts and expansion size, detects extreme compression ratios, and inventories every packaged file.
What the scanner checks
Darky's RAT Checker performs static analysis. Uploaded files are opened as archives and parsed; they are not launched, installed or permitted to contact external systems.
Identity and provenance
Reads Paper, Bukkit, Velocity, Fabric, Quilt, Forge and NeoForge metadata. It calculates SHA-1, SHA-256 and SHA-512 hashes and can compare an exact hash with public registry records.
Class-file analysis
Parses JVM class files, method descriptors, constant strings and invocation instructions. This exposes actual calls to networking, file, process, reflection, class-loading, native and cryptographic APIs.
Code recovery
When a Java decompiler is available, reconstructed source is indexed. Otherwise the service produces readable JVM disassembly with method calls, offsets and strings. Obfuscated files remain inspectable, although names and control flow may be intentionally degraded.
Indicator extraction
Extracts URLs, domains, webhook patterns, tokens with redaction, embedded executables, native libraries, scripts, nested archives and high-entropy or suspiciously named components.
Behavior correlation
High-risk findings require connected capabilities—for example local credential access combined with outbound transmission, or downloading content followed by process execution. A single word does not establish malware.
Evidence, confidence and limitations
Verified evidence
Archive entries, hashes, metadata, constant strings and JVM calls are read directly from the uploaded bytes.
Heuristic evidence
Obfuscation, unusual entropy, suspicious naming and capability combinations raise attention but may also occur in legitimate software.
Not a guarantee
No static scanner can prove a program is harmless. Reflection, encrypted configuration, runtime downloads, native code and environment-triggered logic can conceal behavior.
Public-service controls
Files are size-limited, processed in temporary storage, never executed, and removed after analysis. Reports redact common secrets. Requests are rate-limited and output is bounded to protect service availability. Do not upload files you are not authorized to inspect.