I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java file.

I am using Flare7 and am not able to import any tools due to how we have the environment set up. Are there any tools that can capture these files?

I know DirWatch can save on modification but these are not being modified, also the source code is encrypted or encoded so I can't just search for the file string.

If anyone could help that would be appreciated! Thank you!

  • Can you confirm you are dealing with a Java archive (.jar) and not something that was re-packaged as an exe from a Java source ?
    – Guillaume
    Commented Jul 15, 2021 at 11:18
  • You can use a SecurityManager. It has methods for file access like "checkRead" "checkDelete" etc. If you make your own main method to call the target program you can install your own security manager with these functions to dump file paths it references. Another silly trick would be to instrument/edit the JVM classes (File/Path) so that when their methods are called you log the file path and operation somewhere.
    – Col-E
    Commented Jul 24, 2021 at 5:31


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.