unclassified-autoit-compiled: 2c6133ca — Invoice.exe, 311 KB compiled SCRIPT resource, Jul 2024 build

Executive Summary

Second confirmed sibling of the unclassified-autoit-compiled cluster: an AutoIt v3 single-file compiled PE32 (Invoice.exe, 1.14 MB) with a 311 KB encrypted SCRIPT resource (AU3!EA06 header). Compiled July 2024 — ten months after the first sibling (ac2ca060, May 2023). No hardcoded C2 strings in the outer binary; all threat logic lives inside the compiled AutoIt bytecode. Static-only analysis (CAPE skipped — no Windows guest).^[file.txt]^[rabin2-info.txt]

What It Is

Cluster membership: Confirmed sibling of ac2ca060 (AUG_SOA.exe). Same toolchain (MSVC 14.0), same section layout, same AU3!EA06 SCRIPT resource format, same 19-DLL import table profile. Delta: filename (invoice vs business SOA), resource size (311 KB vs 802 KB), and compilation date (Jul 2024 vs May 2023).^[strings.txt:782]^[strings.txt:1309]

How It Works

1. Launch: The PE is the AutoIt v3 single-file compiler output (AutoItSC). The interpreter runtime initializes, locates the compiled script in .rsrc, decrypts/decompresses it, and begins bytecode execution.^[capa.txt]
2. Script opaqueness: The 311 KB RCDATA resource carries the standard AU3!EA06 header. Without MyAut2Exe or Exe2Aut, the script source is opaque. No hardcoded URLs, IPs, registry keys, or file paths appear in the outer binary.^[terminal:resource-extraction]
3. Runtime capabilities: The import table exposes the full surface the script can reach via AutoIt’s DllCall / WinAPI wrappers:
   • Network: WinInet (HTTP/HTTPS/FTP), WinSock (raw TCP/UDP)^[pefile.txt:906-963]
   • Process manipulation: OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateProcessW, CreateProcessAsUserW^[pefile.txt]
   • Registry: RegSetValueExW, RegCreateKeyExW, RegOpenKeyExW^[pefile.txt]
   • Privilege escalation: AdjustTokenPrivileges, OpenProcessToken, DuplicateTokenEx, LogonUserW^[pefile.txt]
   • Discovery: CreateToolhelp32Snapshot, Process32FirstW/NextW, GetSystemInfo, IsWow64Process^[pefile.txt]
   • Collection: GDI screenshot (CreateCompatibleBitmap, StretchBlt, GetDIBits), clipboard (OpenClipboard, GetClipboardData), keylogging (GetAsyncKeyState, RegisterHotKey)^[pefile.txt]
   • File system: Full CRUD, directory enumeration, temp-file staging^[pefile.txt]
4. Anti-analysis: IsDebuggerPresent imported; no VM-detection strings observed. The compiled script itself provides natural static obfuscation.^[pefile.txt]

Decompiled Behavior

Ghidra analysis of the outer binary reveals only the AutoIt interpreter runtime (C++ MSVC), not the script logic. Key observations:

• Entry point: Standard WinMain-style GUI initialization with CRT startup, followed by interpreter bootstrap.^[ghidra:pending]
• No meaningful decompiled threat logic: All behavioral decisions (C2 URLs, payload staging paths, persistence commands) are inside the encrypted 311 KB SCRIPT resource. The runtime merely dispatches AutoIt opcodes to the imported Win32 APIs listed above.
• PCRE engine: Embedded PCRE regex library (unicode-script tables, error strings) suggests the script uses regex for parsing — likely for data harvesting (browser stores, config files, or C2 responses).^[strings.txt:625-720]

C2 Infrastructure

None recovered statically. The outer binary contains no hardcoded network indicators. C2 endpoints, ports, and protocols are runtime-resolved from within the compiled AutoIt script. The import table confirms capability for both WinInet (HTTP/HTTPS/FTP) and WinSock (raw sockets), but the actual configuration is opaque without script decompilation.

Interesting Tidbits

• Invoice lure: The filename Invoice.exe is a classic business-document social-engineering lure, contrasting with the first sibling’s AUG_SOA.exe (statement of account). This suggests the cluster is used in targeted phishing rather than mass-distribution spam.^[metadata.json]
• Third-party compilation: The string This is a third-party compiled AutoIt script. appears in both siblings, confirming use of the AutoItSC compiler rather than a custom repack.^[strings.txt:782]
• PCRE inclusion: The presence of a full PCRE regex engine inside the binary is unusual for a simple dropper — it points to data-extraction or config-parsing logic in the script layer.^[strings.txt:625-720]
• No UPX: Despite the upx-dec MalwareBazaar label, the binary shows no UPX compression signatures. The high .rsrc entropy (7.89) is explained by the encrypted SCRIPT blob, not packing.^[binwalk.txt]
• Full token-manipulation suite: The ADVAPI32 imports include CreateProcessAsUserW, CreateProcessWithLogonW, and LogonUserW — capabilities beyond typical commodity malware, suggesting potential for credential-driven lateral movement if the script is configured for it.^[pefile.txt]

How To Mess With It (Homelab Replication)

1. Install AutoIt v3 from https://www.autoitscript.com/site/autoit/downloads/
2. Write a simple script (test.au3) using AutoIt’s InetRead, RegWrite, FileWrite, and DllCall to Win32 APIs.
3. Compile with Aut2Exe (x86, GUI mode) → produces a single-file PE with the same section layout.
4. Verify: Run capa on your reproducer — it should flag the same autoit file limitation warning.^[capa.txt]
5. Extract resource: Use Resource Hacker or pefile to dump the RT_RCDATA resource and confirm AU3!EA06 header.

Deployable Signatures

YARA Rule

rule AutoItSC_Invoice_Sibling {
    meta:
        description = "AutoIt v3 single-file compiled PE32 with invoice lure and AU3!EA06 SCRIPT resource"
        author = "pp-hermes"
        date = "2026-06-17"
        hash = "2c6133cab1050c0c1be6649a55b14f5c48298fd7cef042d97326acd068a14f2f"
    strings:
        $au3_header = "AU3!EA06"
        $autoit_str = "This is a third-party compiled AutoIt script."
        $invoice = "Invoice.exe" nocase
        $wininet = "WININET.dll" ascii wide
        $winsock = "WSOCK32.dll" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 5 and
        $au3_header and
        $autoit_str and
        $wininet and
        $winsock and
        pe.imports("WININET.dll", "InternetOpenW") and
        pe.imports("WININET.dll", "HttpSendRequestW")
}

Behavioral Hunt Query (Sigma-like)

title: AutoIt Compiled PE32 Invoice.exe Execution
detection:
    selection:
        - Image|endswith: 'Invoice.exe'
        - CommandLine|contains:
            - 'Invoice.exe'
    selection_autoit:
        - ParentImage|contains: 'Invoice.exe'
        - LoadedImage|contains: 'WININET'
        - LoadedImage|contains: 'WSOCK32'
    condition: selection and selection_autoit

IOC List

Behavioral Fingerprint

This binary is an AutoIt v3 single-file compiled executable (AutoItSC). Upon launch, it initializes the AutoIt interpreter, extracts a 311 KB encrypted SCRIPT resource from .rsrc (header AU3!EA06), and executes the compiled bytecode. The outer import table exposes WinInet (HTTP/HTTPS/FTP), WinSock (raw TCP/UDP), registry write, token manipulation, process injection, and GDI screenshot APIs — but no actual C2 addresses are visible statically. Network indicators, persistence commands, and payload staging paths are resolved at runtime from within the opaque script layer. Detection should focus on the parent-child pattern of Invoice.exe spawning unexpected child processes or making outbound connections shortly after launch.

Detection Signatures

• capa: autoit file limitation — compilation detected, capabilities not fully recoverable^[capa.txt]
• YARA: Suspicious_Wininet_Imports — generic WinInet usage^[yara.txt]
• ATT&CK mapping: T1059.005, T1071.001, T1095, T1547.001, T1053.005, T1083, T1057, T1012, T1113, T1115, T1056.001, T1003, T1496, T1074, T1041, T1105

References

• Artifact ID: 9cef2255-1775-4132-9660-3be6de91ea1d (OpenCTI)
• Source: MalwareBazaar / abuse.ch
• Related wiki: unclassified-autoit-compiled, autoit-compiled-script-dropper
• Sibling: ac2ca060 — AUG_SOA.exe (May 2023 build)

Provenance

• File type: file v5.44^[file.txt]
• PE parsing: pefile 2023.2.7^[pefile.txt]
• Strings: strings v2.42^[strings.txt]
• FLOSS: flare-floss v2.3.0 (failed — argument parsing error, no decoded output)^[floss.txt]
• capa: flare-capa v7.1.0^[capa.txt]
• Binwalk: binwalk v2.3.4^[binwalk.txt]
• radare2: rabin2 v5.9.4^[rabin2-info.txt]
• Metadata: ExifTool v12.76^[exiftool.json]
• Resource extraction: custom pefile Python script (terminal)^[terminal]
• YARA: custom rules (yara v4.3.2)^[yara.txt]
• radare2 analysis: r2 v5.9.4, analysis level 3, 2645 functions^[r2-analysis]
• Ghidra: imported, analysis incomplete at time of report^[ghidra]