unclassified-autoit-compiled: 3a538ef0 — DHL-document lure, 289 KB SCRIPT resource, Jul 2024 build

Executive Summary

Forty-third confirmed sibling in the unclassified-autoit-compiled AutoItSC single-file PE32 dropper cluster. Distributed as Dhl_Document.exe — a shipping-document social-engineering lure matching the DHL airway-bill theme of sibling f618a861. Standard AutoItSC v3.3.8.1 runtime with MSVC 12.0 (VS 2013) linker, compiled Jul 1 2024. Encrypted SCRIPT resource (RT_RCDATA) is 289 KB — larger than the 237 KB in the prior DHL-themed sibling but within cluster norms. No novel obfuscation, payload staging, or C2 strings recovered statically. Threat logic is fully encapsulated in the compiled AutoIt bytecode and opaque without decompilation.

What It Is

Cluster ascription is high-confidence based on:

• AU3!EA06 magic header in .rsrc RT_RCDATA resource ^[strings.txt:1299] ^[strings.txt:1304] ^[strings.txt:1674]
• "This is a third-party compiled AutoIt script." string ^[strings.txt:782]
• Full PCRE regex runtime error-message table in .rdata ^[strings.txt:595-670]
• Standard 5-section PE32 layout (.text, .rdata, .data, .rsrc, .reloc) ^[pefile.txt]
• Empty VS_VERSIONINFO (FileVersion 0.0.0.0, no CompanyName/ProductName strings) ^[pefile.txt:229-273]
• AutoItSC-standard import surface: WinInet, WinSock, ADVAPI32, GDI32, COMCTL32, MPR, PSAPI, IPHLPAPI, USERENV, UxTheme, KERNEL32 ^[pefile.txt:274-501]

How It Works

This is a single-file AutoItSC dropper: the interpreter runtime and compiled script are fused into one PE. On execution, the AutoIt interpreter decrypts and runs the SCRIPT bytecode stored in .rsrc (resource type 10 / RT_RCDATA, ID SCRIPT). The script logic — payload URLs, staging paths, C2 addresses, and any anti-analysis gates — is encrypted and not recoverable via static string extraction.

The .rsrc section is 0x46400 bytes (~289 KB) with entropy 7.06, consistent with an encrypted/compiled script payload. ^[pefile.txt:144-152] No secondary payload resources, icon suites, or decoy images are visible in the resource directory.

Per-cluster behavior (documented at unclassified-autoit-compiled): the script typically drops one or more files to %TEMP% (often with biological/lexical nonce names), optionally stages hex-encoded shellcode, and reflectively loads or process-hollows an inner PE. Inner payloads observed in this cluster include stripped PE32 binaries, .NET Framework assemblies (including agenttesla), and generic infostealers. No C2 strings recovered statically for this sample.

Decompiled Behavior

No Ghidra decompilation attempted — the threat logic lives in the compiled AutoIt bytecode, not in the x86 interpreter runtime. Reverse-engineering the interpreter stub would yield only standard AutoItSC API wrappers. The SCRIPT resource would require autoit-ripper or MyAut2Exe decompilation to recover the original AutoIt source; this was not performed.

C2 Infrastructure

No C2 domains, IPs, URLs, mutex names, or hardcoded paths recovered from static analysis. C2 is runtime-resolved by the compiled script. Previous siblings in this cluster have shown WinInet/WinSock HTTP/HTTPS beaconing and FTP exfiltration, but no indicators were extracted for this sample.

Interesting Tidbits

• DHL lure recurrence: This is the second DHL-themed sibling after f618a861 (DHL_AWB_TRACKING_DETAILS.exe, 14th sibling, 237 KB SCRIPT). The 52 KB size increase in the SCRIPT resource may indicate a longer script or different payload staging logic, but the outer binary fingerprint is otherwise identical. ^[/intel/analyses/f618a8619ab45629df06d80a6d5fec78962a679dbaaca29cf51cf9261973486f.html]
• No icon suite: Unlike siblings f618a861 (four-icon suite) and f51bc678 (256×256 Adobe PDF icon), this sample has no visible icon resources in .rsrc. The empty VS_VERSIONINFO and lack of iconography make it a blander, lower-effort masquerade — relying purely on the filename.
• Timing precision: The PE timestamp 2024-07-01 11:17:22 UTC is precise to the second, suggesting a scripted or CI build rather than manual compilation. This exact timestamp pattern is shared with siblings f3a48a8c (2024-06-27) and 2c6133ca (Jul 2024).
• Standard import surface, no novel APIs: The import table contains no additions or deletions relative to the cluster baseline. No NtUnmapViewOfSection, NtWriteVirtualMemory, or other process-hollowing APIs are imported directly — if process injection occurs, it is done via runtime-resolved APIs or DllCall within the AutoIt script.

How To Mess With It (Homelab Replication)

Not applicable for this sample — the threat is the compiled AutoIt script, not a replicable build technique. To study this cluster, replicate the outer AutoItSC binary by compiling any AutoIt v3 script with the single-file compiler (AutoItSC v3.3.8.1) and compare the resulting PE32 section layout, .rsrc resource structure, and import table to the cluster baseline.

To extract the inner script for analysis:

1. Run autoit-ripper against the PE: autoit-ripper 3a538ef02cc87ab0fd12ffb13cb1c86f31e7d0ec36760296628756b4edb4211e.bin
2. If autoit-ripper fails (script is encrypted or uses a newer AutoItSC version), try myaut2exe or manual resource extraction (rabin2 -xO 0xC3400 0x46400 followed by entropy analysis).
3. Decompiled AutoIt source will reveal payload URLs, file-drop paths, and any string-obfuscation routines (Caesar shifts, XOR keys, permutation tables) that can then be reproduced in Python.

Deployable Signatures

YARA Rule

rule autoitsc_dhl_document_dropper_3a538ef0
{
    meta:
        description = "AutoItSC single-file PE32 dropper — DHL-document lure variant, Jul 2024 build"
        author = "PacketPursuit SOC"
        date = "2026-07-12"
        sha256 = "3a538ef02cc87ab0fd12ffb13cb1c86f31e7d0ec36760296628756b4edb4211e"
        family = "unclassified-autoit-compiled"
    strings:
        $au3_header = "AU3!EA06" ascii wide
        $autoit_str = "This is a third-party compiled AutoIt script." ascii wide
        $pcre_err1 = "internal error: unexpected repeat" ascii
        $pcre_err2 = "this version of PCRE is compiled without UTF support" ascii
        $pcre_err3 = "PCRE does not support \\L, \\l, \\N{name}, \\U, or \\u" ascii
        $vs_empty = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 5 and
        pe.linker_version.major == 12 and
        $au3_header and
        $autoit_str and
        any of ($pcre_err*) and
        pe.imports("WSOCK32.dll") and
        pe.imports("WININET.dll") and
        pe.imports("ADVAPI32.dll")
}

Behavioral Hunt Query (Sigma-like pseudocode)

Target: Process creation events where the parent is explorer.exe or cmd.exe, the child is a PE32 with:

• Filename matching *Dhl*, *Document*, *AWB*, *Tracking*, *Invoice*, *Payment*, *RFQ*, *PO*
• Loads WSOCK32.dll and WININET.dll within 5 seconds of launch
• Creates files in %TEMP% with high-entropy names (≥10 chars, no vowels, or biological/lexical patterns like maneuverability, sulfhydric, camellin, totten)
• Makes outbound HTTP/HTTPS connections within 30 seconds

IOC List

Detection Signatures

References

• Artifact ID: ab35830c-0d4c-4729-a2d2-2c6fc0701926 (OpenCTI)
• Source: MalwareBazaar via OpenCTI urlhaus-recent-payloads connector
• Cluster entity page: unclassified-autoit-compiled
• Sibling analysis (DHL theme): f618a861 — unclassified-autoit-compiled

Provenance

Analysis derived from:

• file.txt — file(1) output
• exiftool.json — EXIF/PE metadata
• pefile.txt — pefile Python library parse
• strings.txt — strings extraction (8-bit)
• rabin2-info.txt — radare2 binary header summary
• capa.txt — Mandiant capa v7 output (AutoIt limitation warning)
• yara.txt — YARA rule matches
• metadata.json — corpus metadata
• dynamic-analysis.md — CAPE skipped (no Windows guest)

No Ghidra decompilation performed. No dynamic execution. All behavioral inferences are static and cite the cluster entity page where family-level patterns are documented.