I’ve just tested the JabRef-2.8.1.jar file which is just a “special zip archive for precompiled Java programs” this works fine without any installation.
Also the .exe installer should be fine - however, I cannot guarantee this as I do not have old hash-Sums of the original installer, i.e., there is a slight possibility that some has modified the installer - but I think you refer to the damn sourceforge installer which has been introduced for some high volume downloads such as FileZilla or Gimp on sourceforge? (See for example this article on the topic.)
This practice should have been stopped by now - and JabRef was never affected by this.