View Single Post
  #2  
Old 09-13-2019, 15:03
chants chants is offline
VIP
 
Join Date: Jul 2016
Posts: 835
Rept. Given: 47
Rept. Rcvd 52 Times in 32 Posts
Thanks Given: 742
Thanks Rcvd at 1,148 Times in 531 Posts
chants Reputation: 52
If it launches a separate java.exe instance, can just look at the command line and see where the jar file is located and grab it?

The code above does not contain crypter which does the encrypt/decrypt, though its doubtful needed since you will use java and this class to do the work anyway. But also we do not see the loader which actually "executes" the "jar" file.

Otherwise, either check for process functions which invoke JVM java.exe or look for code along the lines of:
Code:
// Create a new JavaClassLoader 
ClassLoader classLoader = this.getClass().getClassLoader();

// Load the target class using its binary name
Class loadedMyClass = classLoader.loadClass(classBinName);
Then you can also trace how the class is processed before loading if you want the jar in case it is not invoked by java.exe but instead by dynamic loading. Check more topics on dynamic loading for more info.
Reply With Quote