reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-java-jar-malware/references/api-reference.md

@@ -0,0 +1,38 @@
+# API Reference: Analyzing Java/JAR Malware
+
+## Overview
+
+`scripts/analyst.py` treats a JAR as a ZIP and inventories `.class` files and embedded payloads,
+reads the manifest entry point, detects obfuscator fingerprints and name obfuscation, and scans
+class constant pools for dangerous API usage. It reads the archive statically, never launches the
+JVM, and defangs URLs.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | zipfile, regex, JSON, file IO |
+| CFR / Procyon | optional | decompile recovered classes downstream (not required here) |
+
+## Core functions
+
+### `inspect(path)`
+Returns class count, `Main-Class`, embedded payloads, resources, obfuscators, a name-obfuscation
+flag, capability APIs, and defanged URLs.
+
+## Capability APIs flagged
+
+`Runtime`/`ProcessBuilder` (exec), `java.lang.reflect` + `URLClassLoader` (reflective loading),
+`javax.crypto` (encryption), `java.net.Socket`/`URL` (networking), `java.awt.Robot` (surveillance).
+
+## Usage
+
+```bash
+python scripts/analyst.py inspect sample.jar
+```
+
+## Sources
+
+- JVM specification (class file format, constant pool) — https://docs.oracle.com/javase/specs/jvms/se17/html/
+- JAR/ZIP structure and `MANIFEST.MF` `Main-Class` from the Java platform documentation
+- Obfuscator fingerprints (Allatori/ProGuard/Zelix) from public Java-malware analyses