unclassified-autoit-compiled: 2d720f57 — Purchase_Order_423737.exe, Charley-branded VS_VERSIONINFO, Sep 2024 build

Executive Summary

Forty-sixth confirmed sibling in the AutoItSC single-file PE32 cluster. Filename Purchase_Order_423737.exe carries a numeric tracking-code lure targeting procurement/finance workflows. Notable for a non-empty VS_VERSIONINFO with CompanyName "Charley" and FileVersion 3.5.5.7 — a cluster outlier, as most siblings present empty version blocks. Encrypted 258 KB SCRIPT resource in .rsrc with standard AU3!EA06 AutoItSC v3.3.8.1 header. MSVC 12.0 (VS 2013) linker, genuine Sep 2024 PE timestamp, plain (non-UPX) PE32. Static-only analysis; no CAPE detonation possible.

What It Is

• File: Purchase_Order_423737.exe — PE32 executable (GUI) Intel 80386, 5 sections ^[file.txt]
• Size: 1,159,680 bytes (~1.13 MB)
• Build: AutoItSC v3.3.8.1 single-file compiled PE32 ^[strings.txt:776]
• Linker: Microsoft linker 12.0 (Visual Studio 2013) ^[pefile.txt:45]
• Timestamp: Thu Sep 12 23:58:23 2024 UTC — genuine build date ^[pefile.txt:34]
• Script placement: .rsrc RT_RCDATA ID=SCRIPT, 258,197 bytes, entropy 7.999 (encrypted/compiled bytecode) ^[strings.txt:1297,1755]
• Signing: Unsigned ^[rabin2-info.txt:27]
• Packing: None — plain PE32, not UPX-compressed

Cluster membership: Confirmed sibling of unclassified-autoit-compiled (n=46). See cluster entity page for shared build fingerprint, import surface, and known inner-payload patterns.

How It Works

The binary is a standard AutoItSC v3.3.8.1 single-file executable: the C++ interpreter runtime (compiled with MSVC 12.0) is fused with an encrypted AutoIt v3 script bytecode payload stored as an RT_RCDATA resource named SCRIPT in the .rsrc section. At runtime, the interpreter decrypts and executes the bytecode inside its own process. The script logic is opaque without decompilation; no payload filenames, shellcode strings, or C2 indicators were recovered statically.

What distinguishes this sample from cluster siblings:

1. VS_VERSIONINFO branding: CompanyName "Charley", FileVersion "3.5.5.7", ProductVersion 0.0.0.0 ^[exiftool.json:36-37]. Most cluster siblings (e.g., 3f3540e1, 7c706df3, f618a861) present empty or trivial VS_VERSIONINFO blocks. This is the first observed sibling with a plausible (if meaningless) company name.
2. Purchase-order tracking-code lure: Numeric suffix 423737 mimics procurement document tracking codes, a social-engineering refinement over generic Invoice.exe or Purchase_Order.exe filenames. British English LangID (080904B0) ^[exiftool.json:34].
3. Mid-size script payload: 258 KB is mid-range for the cluster (smallest: 183 KB in ef71e0f6; largest: 1.11 MB in 5833e797).
4. Older toolchain: MSVC 12.0 (VS 2013) linker vs. the more common MSVC 14.16 (VS 2017) seen in siblings like 3f3540e1 and 6718622d.
5. Genuine build timestamp: Sep 2024, not the fabricated Jan 2012 PE timestamp seen in overlay-placement siblings (ff84806a, e5647a2d, f346b7e9).
6. Four-icon suite: Small icon set in .rsrc — some siblings carry 11–15 icons.

Decompiled Behavior

Ghidra/r2 analysis of the AutoItSC C++ runtime entry point (entry0 at 0x00427f4a) shows standard initialization: heap setup, command-line retrieval via GetCommandLineW, resource enumeration, and script decryption/execution dispatch. No anomalous control-flow obfuscation in the runtime itself. The interpreter locates the SCRIPT resource, decrypts it in-memory, and hands execution to the AutoIt bytecode VM. All threat logic lives in the encrypted script layer.

C2 Infrastructure

None recovered statically. The AutoIt script bytecode is encrypted (entropy 7.999). Known cluster siblings have delivered inner payloads with SMTP, HTTP, FTP, and raw TCP C2, but this sample's specific C2 is not inferable without decompilation or dynamic execution. The import table includes both WinInet (HTTP/FTP) and WinSock (raw TCP/UDP) surfaces, so any of these channels are possible at runtime.

Interesting Tidbits

• The "Charley" company name in VS_VERSIONINFO is unique in the cluster. It may be a placeholder from an AutoIt compiler configuration, a deliberate masquerade, or an artifact of the build environment. No other cluster sibling uses this string.
• The filename Purchase_Order_423737.exe follows the tracking-code pattern observed in sibling 498f7bf3 (NEA062E23) and 3f3540e1 (202400864), but with a simpler all-numeric suffix.
• PCRE regex runtime strings are present in the binary (standard for AutoItSC v3.3.8.1) ^[strings.txt:607-694], confirming the full regex engine is compiled into the runtime — useful for script-side data harvesting if the inner payload uses regex.
• No shellcode-related strings were found in the plaintext binary surface, but this does not preclude an encrypted shellcode-staging routine inside the script (as observed in siblings 763ae850, 6718622d, 498f7bf3).

How To Mess With It (Homelab Replication)

To reproduce a comparable AutoItSC single-file binary:

1. Install AutoIt v3.3.8.1 or later from https://www.autoitscript.com/
2. Write an AutoIt v3 script (e.g., payload.au3) using FileInstall, InetRead, RegWrite, Run, etc.
3. Compile with Aut2Exe.exe (right-click → Compile Script) or AutoItSC command-line:

   "C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe" /in payload.au3 /out Purchase_Order_423737.exe /icon icon.ico /x86
   

4. Verify with file <output.exe> — should report PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
5. Run capa on the output — should hit the (internal) autoit file limitation rule
6. Verify SCRIPT resource with Resource Hacker or pefile Python script — confirm RT_RCDATA ID=SCRIPT with AU3!EA06 header
7. Compare import table to this sample's pefile.txt — should show KERNEL32, USER32, GDI32, ADVAPI32, SHELL32, OLE32, OLEAUT32, WSOCK32, WININET, COMCTL32, WINMM, MPR, PSAPI, IPHLPAPI, USERENV, VERSION, UxTheme

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_Charley_Version
{
    meta:
        description = "AutoItSC v3.3.8.1 single-file PE32 with Charley VS_VERSIONINFO and purchase-order lure"
        author = "PacketPursuit"
        date = "2026-07-14"
        hash = "2d720f57766050b9ac19ab38c1352f7b064bf194a616613468befdcaf4e51ff3"
        family = "unclassified-autoit-compiled"

    strings:
        $au3_header = "AU3!EA06"
        $charley = "Charley" wide
        $filever = "3.5.5.7" wide
        $autoit_msg = "This is a third-party compiled AutoIt script."
        $pcre_err1 = "numbers out of order in {} quantifier"
        $pcre_err2 = "range out of order in character class"
        $pcre_err3 = "reference to non-existent subpattern"

    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x4550 and
        // Must be PE32, not PE32+
        uint16(uint32(0x3C) + 0x18) == 0x10B and
        // AutoIt indicators
        ($au3_header or $autoit_msg) and
        // Charley-specific branding
        ($charley and $filever) and
        // PCRE runtime confirmation
        2 of ($pcre_err*)
}

Behavioral Hunt Query (KQL/Sigma-style)

title: AutoItSC Single-File Execution with Procurement Lure
description: Detects execution of AutoIt-compiled PE32 with purchase-order/invoice/RFQ filenames and WinInet/WinSock network activity
logsource:
  product: windows
  service: sysmon
detection:
  selection_image:
    Image|endswith:
      - '.exe'
    Image|contains:
      - 'Purchase_Order'
      - 'Invoice'
      - 'RFQ'
      - 'Quotation'
      - 'Payment'
      - 'Bank_Details'
      - 'SOA'
      - 'DHL'
      - 'AWB'
  selection_network:
    - Initiated: true
      Image|endswith:
        - '.exe'
    - CommandLine|contains:
        - 'powershell'
        - 'cmd.exe'
        - 'wscript'
  selection_autoit_imports:
    # In EDR telemetry: process loads both WSOCK32 and WININET
    - LoadedImage|endswith:
        - 'WSOCK32.dll'
        - 'WININET.dll'
  condition: selection_image and (selection_network or selection_autoit_imports)
falsepositives:
  - Legitimate AutoIt scripts compiled in-house
  - Benign procurement software (unlikely to match network + filename pattern)
level: high

IOC List

Behavioral Fingerprint

This binary is a single-file AutoIt v3 compiled executable (AutoItSC) that loads its encrypted script bytecode from an RT_RCDATA resource named SCRIPT in the PE .rsrc section. The interpreter runtime is a C++ PE32 compiled with MSVC 12.0 (VS 2013), presenting a full Windows API import surface including WinInet, WinSock, ADVAPI32 (registry/token APIs), and GDI32. The binary executes as a GUI process, reads its own embedded resource, decrypts the script in-memory, and runs it via the AutoIt bytecode VM. No secondary files are required. Network activity (HTTP, FTP, or raw TCP/UDP) occurs from within the interpreter process after script decryption. Persistence, if any, is implemented in script logic rather than the C++ runtime.

Detection Signatures

• Mandiant capa: (internal) autoit file limitation — capa cannot analyze AutoIt scripts; runtime-only capability detection is misleading ^[capa.txt]
• YARA triage: PE_File_Generic, Suspicious_Wininet_Imports ^[yara.txt]
• PE indicators: GUI subsystem, 5 sections, no .NET CLR header, no delay imports, no TLS callbacks, standard IAT at .rdata

References

• unclassified-autoit-compiled — Cluster entity page with full sibling list and shared build fingerprint
• autoit-compiled-script-dropper — Concept page covering AutoIt deployment patterns
• social-engineering-filename-lure — Generic social-engineering technique page
• Abuse.ch MalwareBazaar artifact: SHA-256 2d720f57766050b9ac19ab38c1352f7b064bf194a616613468befdcaf4e51ff3
• OpenCTI labels: exe, malware-bazaar

Provenance

Analysis based on static artifacts: file.txt, exiftool.json, pefile.txt, strings.txt, rabin2-info.txt, capa.txt, yara.txt, binwalk.txt, metadata.json, triage.json. FLOSS execution failed (CLI argument error). Ghidra not invoked; radare2 provided entry-point decompilation. Dynamic analysis skipped — no CAPE Windows guest available. Tool versions: ExifTool 12.76, pefile (Python), radare2 5.x, capa 7.x, YARA 4.x.