formbook: 3424a53f — purchase-order lure with C33JA stride-3 shellcode bootstrap

Executive Summary

AutoItSC-compiled dropper (PO#86637.exe, Aug 2024) delivering what triage tags as Formbook. Outer AutoIt layer uses a stride-3 hex decoder (C33JA) to obfuscate API names and an anti-debug timing gate before dropping finitism/extrorsal payload pair to %TEMP%. The second stage is a RWX-allocation shellcode bootstrap jumping to offset +9136. No network IOCs recovered statically — C2 lives inside the encrypted finitism payload (entropy 7.995). Second confirmed Formbook sibling in this corpus.

What It Is

• SHA-256: 3424a53f5b4c7422f142ec1e6460b55e5da222113d45e9cf4f2f9f1013e3bcaa
• Filename: PO#86637.exe — purchase-order social-engineering lure ^[triage.json]
• File type: PE32 executable (GUI) Intel 80386, 5 sections ^[file.txt]
• Size: 1,322,496 bytes (1.29 MB) ^[triage.json]
• Compiler / linker: MSVC 14.16 (Visual Studio 2017), AutoItSC v3 single-file compiled ^[pefile.txt] ^[rabin2-info.txt]
• Compilation timestamp: Sun Aug 25 23:26:16 2024 UTC ^[pefile.txt]
• Version info: 5.4.1.4, English (British), Win32, no product version ^[exiftool.json]
• Signing: Unsigned ^[rabin2-info.txt]
• ASLR: Enabled (DYNAMIC_BASE) ^[pefile.txt]
• DEP/NX: Disabled (nx: false) ^[rabin2-info.txt]

How It Works

Outer Layer — AutoItSC Dropper

The binary is a standard AutoItSC single-file PE: the interpreter and a 407 KB EA06 AutoIt script are embedded in .rsrc type RT_RCDATA ^[pefile.txt:186] ^[autoit-ripper extraction]. autoit-ripper successfully extracted three files: script.au3, finitism, and extrorsal.

Obfuscation — C33JA Stride-3 Hex Decoder

The script defines function C33JA that iterates over a string in steps of 3, taking the first two characters of each triplet as a hex byte pair and discarding the third as noise ^[script.au3:27-34]. This is the same technique documented at autoit-stride3-hex-decoder; it is used here to decode both API names (kernel32.dll, VirtualAlloc, CreateFile, ReadFile, GetTickCount, Sleep) and DllStruct type signatures (byte[, dword, ptr, handle).

Anti-Analysis — Timing Gate

F34YM10JU(500) calls GetTickCount, Sleep(500), then GetTickCount again and exits if the delta is outside [-500+-4, +500+-4] ^[script.au3:36-45]. This is a classic anti-debug / anti-sandbox gate: debuggers and emulators often accelerate or skip sleeps, producing anomalous deltas.

Payload Staging

1. FileInstall("finitism", @TempDir & "\finitism", 1) ^[script.au3:46]
2. FileInstall("extrorsal", @TempDir & "\extrorsal", 1) ^[script.au3:47]
3. Opens extrorsal via CreateFile (read-only, sequential scan) ^[script.au3:48]
4. Reads entire file into a buffer via ReadFile + GetFileSizeEx ^[script.au3:50-54]
5. Decodes the buffer with Execute("C33ja(BinaryToString($N3831iG8z))") ^[script.au3:57]
6. Allocates RWX memory via VirtualAlloc(0, len, 0x3000, 0x40) ^[script.au3:58]
7. Copies decoded payload into the allocation ^[script.au3:59-60]
8. Jumps to offset +9136 via DllCallAddress("int", base+9136) ^[script.au3:61]

Payload Files

The extrorsal file, when decoded with the same stride-3 method, yields shellcode that begins with a push sequence (entropy ~4.2, not uniformly random), suggesting a structured x86 routine rather than a fully encrypted block. The jump target +9136 implies the shellcode performs setup (e.g., API resolution, payload decryption) before handing off to the finitism payload.

Junk-Code Obfuscation

After the real payload execution (line 61), the remainder of script.au3 (lines 62-7268) is a massive forest of dead AutoIt API calls: Sin, GUICtrlGetHandle, StringLower, MouseWheel, ProcessList, PixelChecksum, WinGetClassList, etc., nested in contradictory If/ElseIf/Else branches with literal numeric comparisons that can never be true ^[script.au3:62-200]. This is purely to inflate line count and frustrate static analysis.

Decompiled Behavior

radare2 analysis level 3 on the outer PE identifies 2,892 functions. The entry point (0x00420577) sets up SEH, calls runtime initializers, then jumps to main at 0x00401c60 ^[r2:entry0]. The AutoIt interpreter handles script dispatch; the decompiled C is standard MSVC CRT bootstrap with AutoIt-specific pre-init hooks. No noteworthy native-code anti-analysis beyond the interpreter itself.

C2 Infrastructure

No network IOCs recovered. The script contains no hardcoded URLs, IPs, domains, SMTP credentials, or Telegram bot tokens. C2 configuration is almost certainly encrypted inside the finitism payload, which would require dynamic execution or manual decryption of the 289 KB blob to recover. The shellcode at +9136 may perform runtime C2 resolution.

Static-only inference: the binary imports WININET.dll (HttpOpenRequestW, HttpSendRequestW, InternetReadFile, InternetConnectW) and WSOCK32.dll (socket, connect, send, recv) at the PE level ^[pefile.txt:275-308], providing the networking primitives expected for Formbook's HTTP C2.

Interesting Tidbits

• Filename masquerade: PO#86637.exe — purchase order theme, consistent with Formbook's documented use of procurement lures ^[triage.json].
• Timing gate delta: The check uses 4294966796 (which is 0xFFFFFFEC, i.e., -20 in signed 32-bit) as the lower bound offset ^[script.au3:40]. The gate allows a delta of roughly 480-520 ms around the 500 ms sleep.
• Payload naming: finitism (philosophical term for the doctrine of finitude) and extrorsal (obsolete term meaning "outward, external") continue the biological/lexical nonce pattern observed in other Formbook siblings (e.g., pteropod/bohmite in sample a4cb4c76).
• No orphan payload risk: FileInstall copies overwrite existing files (flag 1), ensuring the payload is fresh on every run.
• DEP disabled: The outer PE runs with nx: false, matching Formbook's need to execute shellcode in dynamically allocated RWX pages without additional VirtualProtect calls.

Deployable Signatures

YARA rule

rule Formbook_AutoItSC_C33JA_Stride3 {
    meta:
        description = "Formbook AutoItSC dropper with C33JA stride-3 hex decoder"
        author = "Titus / PacketPursuit"
        date = "2026-07-12"
        sha256 = "3424a53f5b4c7422f142ec1e6460b55e5da222113d45e9cf4f2f9f1013e3bcaa"
        family = "formbook"
    strings:
        $au3_magic = "AU3!EA06" ascii
        $c33ja_func = "Func C33JA" ascii wide nocase
        $c33ja_call = "C33JA" ascii wide
        $timing_gate = "GetTickCount" ascii wide
        $fileinstall1 = "FileInstall ( \"finitism\"" ascii wide nocase
        $fileinstall2 = "FileInstall ( \"extrorsal\"" ascii wide nocase
        $dllcall_addr = "DllCallAddress" ascii wide
        $rwx_alloc = "0x3000" ascii wide
        $exec_flags = "0x40" ascii wide
        $autoit_banner = "This is a third-party compiled AutoIt script." ascii
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections >= 5 and
        $autoit_banner and
        ($c33ja_func or $c33ja_call) and
        any of ($fileinstall*) and
        $dllcall_addr and
        $rwx_alloc and
        $exec_flags
}

Behavioral fingerprint

This binary is an AutoItSC single-file PE that, upon execution, drops two files to %TEMP% — one named with an obscure biological/philosophical nonce (e.g., finitism, extrorsal, pteropod, bohmite). It calls GetTickCount before and after a ~500 ms Sleep, exiting if the delta deviates. It then hex-decodes one payload with a stride-3 noise-discard routine, allocates RWX memory via VirtualAlloc(0x3000, 0x40), and transfers control via DllCallAddress to an offset inside the allocation. No C2 strings are visible in the AutoIt script; the inner payload is high-entropy and requires dynamic detonation to recover network indicators.

IOC list

Detection Signatures

• MITRE ATT&CK:
  • T1059.005 — Visual Basic / AutoIt execution ^[script.au3:1]
  • T1055.012 — Process Injection: Reflective execution via VirtualAlloc RWX + DllCallAddress ^[script.au3:58-61]
  • T1027.002 — Obfuscated Files or Information: stride-3 hex encoding ^[script.au3:27-34]
  • T1497.001 — Virtualization/Sandbox Evasion: GetTickCount timing gate ^[script.au3:36-45]
  • T1105 — Ingress Tool Transfer: FileInstall drops payload files ^[script.au3:46-47]

References

• Artifact ID: 6ab0321d-f826-41f6-842a-be6cd80c45ee
• MalwareBazaar source: tagged formbook
• Related wiki pages:
  • formbook — family entity page
  • autoit-stride3-hex-decoder — obfuscation technique
  • autoit-timing-gate-sandbox-evasion — anti-debug timing gate technique
  • unclassified-autoit-compiled — broader AutoItSC cluster

Provenance

Static analysis of <sample 3424a53f5b4c.bin> on 2026-07-12 using:

• file (PE32)
• pefile (section headers, imports, resources)
• radare2 (entrypoint, analysis)
• autoit-ripper (EA06 script extraction)
• strings (ASCII strings)
• exiftool (version info)
• Custom Python decoder (stride-3 hex decoding of extrorsal)
• No dynamic execution performed (CAPE skipped, no Windows guest available).