API Reference: Analyzing Java/JAR Malware

Overview

scripts/analyst.py treats a JAR as a ZIP and inventories .class files and embedded payloads, reads the manifest entry point, detects obfuscator fingerprints and name obfuscation, and scans class constant pools for dangerous API usage. It reads the archive statically, never launches the JVM, and defangs URLs.

Dependencies

Package	Version	Purpose
(stdlib)	—	zipfile, regex, JSON, file IO
CFR / Procyon	optional	decompile recovered classes downstream (not required here)

Core functions

`inspect(path)`

Returns class count, Main-Class, embedded payloads, resources, obfuscators, a name-obfuscation flag, capability APIs, and defanged URLs.

Capability APIs flagged

Runtime/ProcessBuilder (exec), java.lang.reflect + URLClassLoader (reflective loading), javax.crypto (encryption), java.net.Socket/URL (networking), java.awt.Robot (surveillance).

Usage

python scripts/analyst.py inspect sample.jar

Sources

JVM specification (class file format, constant pool) — https://docs.oracle.com/javase/specs/jvms/se17/html/
JAR/ZIP structure and MANIFEST.MF Main-Class from the Java platform documentation
Obfuscator fingerprints (Allatori/ProGuard/Zelix) from public Java-malware analyses

1.4 KiB Raw Blame History