z���#'�}��<����N]�W��D�ꚣ"n7~�|�T�-$Ϗbg,�j"�- ��P�1��'�y��o�.���d�1��j�d��i�4��0�ɞ��#뭷}��S�`1�s���tЍaߡ�*^a61�E�6,m�$'m0�w��q��Ζ�*�U���L���Cܫ�2�\cV����=+�B�=lKYK��n�l��̩X��,8�v*1�ȕ�h�mm�ݓ����N��^�M�"��M5�����R�y9�A��;���V��C\�����oe�>L=��*�L�MpN�0���ؒ��V�����|>os�^`ݟ��Q��;���%�OaU�C%�T�v�tyB{��D[�~�� �@�� C>����ԟ��e}9�{��#�d��C�L҉�<5� ������f*�r�1 ����7�#S�P���0%~�$���f��3�RQ5�m�x�:�u'UyM�Cw�cG���:�0ȟ����M�(�| �W����a�/B�d�mP�ȊQ_��?0o�d�x�rF��}���s\N���3^O�$�*�:�"0:u�c��Ld=*?G�F�L@�#�.��� $�$��-%�I�?$�LL�*v՜��i9�ד �1pz:i|ڨ��<�B;���c��=욌u���d�ˬy�:��*v���t�������;�\�v}�զdXh��O��W�JN�w�����C���d�!�%��ث���,&i �m�ˈ�zj���g�?,ڽ�����0��aMQ�*R����D���+�?��m��*+����F,�����yS����;R܊��#]]}���`H���j�a��.��˯_ ��.��~]��W�0_.�o��z�(ߦ���m3٧'�^�Y�2�z��C��� +� ����O�`a+��`�$���@��;��Vk� �'"V2�NQ���X�\��}���T0ıAFP䋬���$Dw��{%��������.��Ae��剱�<�؏:b�#��J0�V(����E��M�7j�9"��=(5��n��X (����*D@��Ƶ�|S��#��W�H�����fG�/�p^I5q��soG���O������*�2K��+q�n�Z^6���>�h��\�u�-��oF��Fp8-��� ���e5eH����kC��1%�ՆW]�61p���:f06��C$�f ;���-�pov�q��KZ��NT9(�nV�RΞ�"�Sf9C8$t�M̩f�^7;�Cn�Ŷ�1YJ�@������Ģ(o�@��`�r�WTv=u�nX�������?s.i�,�� U��C�zg��S���.�.E�D��d���kZ�&Rs��0�Ubf^�ˤ`�k=J�í�4�$�6��C�ip�L����{ ���|�E�Ȃ��_Z�N�b�2���̚00�f�1m ����t��J"����Y����*��7����qpւ�ɂ�e��Yk�/q� � �o_���mC�;�ԢP �}[9N �������C�Dm��W���h�D!���� ��m����M@u��n�qz� �:?7�َ�5����Q.���(� � �>��Qt�wE|�;��]�� ��Lx�aL�X��Poӥ�4��AT.fg1��~�l�v�{5��']�o��,�� ����7�]�����"Ϩ��Kl�ru��P�|7������n�=w� 19���H���@�I|+�����"�����#�Ud��ۥ��`���Y�O�)��I��+�U�O�8LL�g�Y����AN4��7E:bF[�pO���=�����>�LhE����}�J��L{����X��T�����̭�>�� �E3e�Y�"�>_�N�!��AkFu�����,��z�_��v]7�e�١41�u+D �js� )�����5���KՃ��_�ε�i����v��:�s�__����¸�H~>/�&(�U��{���X�~���ou$Z2��sf\��\PL �5�J�Y��d���u�+�s�xf]5<�k2�9�# �#[�(3r�<_�!���;���c7o���9.�8t�Ai��G��Z��z@�*1�3���-u���죤,��JHI)��Yxm��K�������� ���I] U�]C���J�V�w)��b�~�p0�h�ԕ&�&���̠`��p��P�<T��]���Ɠ%���mk)O���� �r{��@���9v��I(�+nD�?#�a;�p#�M*��yXKJ(��x���wY�|�V�=! �?�%���hIM+�ɍ�&՝�*��K yٲN�@�k_i>�5k���آ�H����\j�2�L��Qrbo�����c�v&88��h�?���o�d?�g� �E��/T����$T�k�"��4+���N�&�ұ��&/�!�!~'G�vJB�e���>�~��2$��1Y�)�����^����Q7K�n�X��;��Z^;x"��}[�ǧ���>����=�swc 26�'P�9�w/h�tc UT�5�]���j/��9���G�]OS��~J3��U��%�r�����G��v�-2I��5�%9Gڢo��MJ���}�ֳ�Z� �P5�_�َ�Z2~"��T����y-t�`�Lu�@����%�s��Ur#����mc�i��xR���W�ս�|#h��-������kJҿ6aT����O�HS�[�{7٬�ɘЖh�����O�ʛ�0��d��]��n��*��m�z�q�����p㩽���A��-l��'X>��'+`[K{dJ�J/�s�N>���d& �_����ؗ�7+~�T���x�ȁ�c�&�ɵ��:�t�.t�Ww*�4�i��T}=L[��7M��K#B-c:o����\��Q�,��l������-� ml9R�̬r�J���1� �"{� W����ۙJB"Ͳ8E��������Df��GD��i$��.%ö�@��Y#���_,�w��ʅۣ�PR�U!�h�&�Ը�y�C�՟N�m���J�q��7�#�;���d6 ��$��W�~m����샌7G Bhߩ�YAw_���́U������3�)����I�b�����ߊ�q��~i�����_����,ܳP��_�b�13M�_U�p��:���XK�EU�)�R_����rk!����fgie �B�a��-��w��Ek$�o���Ԅ��R�T��eyr��à��ߓ"�ݗa�����B��%QK0B��E��|�~|�m�3K���.���B��:kj���¥&��V�����\��B�X�e`6��O���Fo���]�ۗ����b�N��P�a�K��"���\9n�J}���!W���T}��%ہ
Static task
static1
Behavioral task
behavioral1
Sample
Block-Autocad_blackrock.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Block-Autocad_blackrock.exe
Resource
win10v2004-20230915-en
General
-
Target
Block-Autocad_blackrock.exe
-
Size
3.4MB
-
MD5
1b9bab0d94bdba9938719b5e309d91f1
-
SHA1
fd7095b2fafc80ef4ed4b590ee54f904b8c7e215
-
SHA256
5879e8c5ab656efa3acc6845d92a0666bc5587cfb22bbe271c6af6c3d6f50c76
-
SHA512
8f96e9a449061cc4a9e1b432fb5a82bb08a62f25bb9784f62aafd80df95a64c51d80524e032e015ad78d50cc067c2fcecd3dd7ac5509dba9b907e32d190b66e5
-
SSDEEP
98304:EIFD6qQq8o/c0G4FjV2WE1xBXCfMiso1haaIz:P6q64LcxQsoZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Block-Autocad_blackrock.exe
Files
-
Block-Autocad_blackrock.exe.exe windows:4 windows x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 5KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 31KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 13KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 265KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 273KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE