1

I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java file.

I am using Flare7 and am not able to import any tools due to how we have the environment set up. Are there any tools that can capture these files?

I know DirWatch can save on modification but these are not being modified, also the source code is encrypted or encoded so I can't just search for the file string.

If anyone could help that would be appreciated! Thank you!

Improve this question
2
  • Can you confirm you are dealing with a Java archive (.jar) and not something that was re-packaged as an exe from a Java source ?
    – Guillaume
    Jul 15, 2021 at 11:18
  • You can use a SecurityManager. It has methods for file access like "checkRead" "checkDelete" etc. If you make your own main method to call the target program you can install your own security manager with these functions to dump file paths it references. Another silly trick would be to instrument/edit the JVM classes (File/Path) so that when their methods are called you log the file path and operation somewhere.
    – Col-E
    Jul 24, 2021 at 5:31

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.