39 lines
1.4 KiB
Markdown
39 lines
1.4 KiB
Markdown
# API Reference: Analyzing Java/JAR Malware
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` treats a JAR as a ZIP and inventories `.class` files and embedded payloads,
|
|
reads the manifest entry point, detects obfuscator fingerprints and name obfuscation, and scans
|
|
class constant pools for dangerous API usage. It reads the archive statically, never launches the
|
|
JVM, and defangs URLs.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | zipfile, regex, JSON, file IO |
|
|
| CFR / Procyon | optional | decompile recovered classes downstream (not required here) |
|
|
|
|
## Core functions
|
|
|
|
### `inspect(path)`
|
|
Returns class count, `Main-Class`, embedded payloads, resources, obfuscators, a name-obfuscation
|
|
flag, capability APIs, and defanged URLs.
|
|
|
|
## Capability APIs flagged
|
|
|
|
`Runtime`/`ProcessBuilder` (exec), `java.lang.reflect` + `URLClassLoader` (reflective loading),
|
|
`javax.crypto` (encryption), `java.net.Socket`/`URL` (networking), `java.awt.Robot` (surveillance).
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py inspect sample.jar
|
|
```
|
|
|
|
## Sources
|
|
|
|
- JVM specification (class file format, constant pool) — https://docs.oracle.com/javase/specs/jvms/se17/html/
|
|
- JAR/ZIP structure and `MANIFEST.MF` `Main-Class` from the Java platform documentation
|
|
- Obfuscator fingerprints (Allatori/ProGuard/Zelix) from public Java-malware analyses
|