Analyzing JAR Files

Overview of JAR Files

• JAR (Java ARchive): A cross-platform file format used for packaging Java class files and associated metadata and resources into a single file.

• Cross-Platform Benefit: JAR files can be used across various operating systems like Windows, Linux, Mac, and Android, which can potentially affect multiple endpoints.

Tools for Analyzing JAR Files

1. jd-gui: A tool for decompiling Java class files in JAR archives to view source code.

2. Visual Studio Code (VS Code) with Java Extension Pack: Provides Java development features and debugging capabilities.

Steps for Analysis

1. Setup Environment:

   • Install Visual Studio Code: Ensure it is installed from previous sessions.

   • Install Java Extension Pack:

     • Open VS Code.

     • Go to Extensions (square blocks icon).

     • Search for and install Java Extension Pack by Microsoft.

   • Run FakeNet: To intercept outgoing traffic during analysis.

2. Analyze JAR File:

   • Open JAR File in jd-gui:

     • Launch jd-gui and open the JAR file or drag and drop it into the tool.

     • Inspect the MANIFEST.MF file found under META-INF to identify the entry point class (e.g., Xforce).

3. Decompile and Save Source Code:

   • Decompiled Source:

     • View and analyze the decompiled source code in jd-gui.

     • Save the decompiled sources by selecting File > Save All Sources.

   • Extract Source:

     • Extract the saved archive into a folder.

4. Debug with VS Code:

   • Open Decompiled Source:

     • In VS Code, open the folder containing the decompiled Java source files.

   • Set Breakpoints:

     • Open the entry point class (e.g., Xforce.java).

     • Place a breakpoint at the first line of the main method.

   • Run and Debug:

     • Click the debug icon and select Run and Debug.

     • If errors occur, resolve them by importing missing Java packages. Use Quick Fix to handle unresolved names.

     • Save changes and continue debugging.

   • Monitor Network Activity:

     • Step through the code to observe interactions. Check FakeNet for network requests and payloads.

     • Look for GET requests or payload downloads (e.g., dummy.exe), which indicates the JAR is a payload downloader.

Summary

• JAR File Analysis:

  • Decompile the JAR using jd-gui to view source code.

  • Debug the decompiled source in VS Code with Java Extension Pack.

  • Monitor network activity to understand payload behavior.

These steps help in understanding the functionality and behavior of Java-based malware by inspecting and debugging JAR files.