unclassified-autoit-compiled: 3f3540e1 — RFQ/ENQUIRY_ORDER tracking-code lure, 381 KB encrypted SCRIPT

Executive Summary

Forty-fourth confirmed sibling in the unclassified-autoit-compiled AutoItSC single-file PE32 cluster. Delivered as RFQ__ENQUIRY_ORDER__202400864.exe, a procurement-themed social-engineering lure with an embedded 390,260-byte encrypted AutoIt script (RT_RCDATA ID=SCRIPT). Plain PE32 (non-UPX), MSVC 14.16 linker, Aug 2024 build timestamp. Full WinInet/WinSock/ADVAPI32/GDI import surface; no plaintext C2 recovered. Static-only analysis.

What It Is

This sample is structurally identical to the AutoItSC cluster fingerprint documented at unclassified-autoit-compiled: single-file PE32 with the interpreter runtime and compiled script fused into one binary, 5 standard sections, empty or minimal VS_VERSIONINFO, and a broad import table drawn from the AutoIt runtime itself.

How It Works

The binary is a direct output of the AutoIt v3 single-file compiler (AutoItSC). On launch, the embedded interpreter decrypts and executes the compiled script bytecode stored in the .rsrc section. The script logic itself is opaque to static analysis without decompilation.

Cluster deltas for this sample:

• Lure theme: First observed sibling with an explicit RFQ__ENQUIRY_ORDER__ filename pattern and a numeric tracking code (202400864). The triple-underscore delimiter and mixed-case ENQUIRY_ORDER suggest targeting Commonwealth English-speaking procurement/finance departments.
• Script size: 390,260 bytes places this sample in the mid-range of the cluster (range: 183 KB – 1.11 MB). Notable: smaller than the 1.11 MB YASREF sibling (5833e797) but larger than the 183 KB banking-details sibling (cca7d56d).
• Icon suite: 11 standard icons (IDs 1–11) plus one 16×16 icon (ID=313) in .rsrc. This is a moderately sized icon suite — more than the 4-icon DHL sibling (f618a861) but fewer than the 12-icon fb5bc543 sibling.
• No UPX packing: Unlike siblings 498f7bf3, 68e48a8c, 6cc26f7c, d86e0912, and c310cb2e, this sample is a plain PE32 with no compression wrapper.
• No overlay: Script is stored in .rsrc (not file overlay), consistent with the majority of the cluster.

Decompiled Behavior

radare2 analysis at level 2 recovered 2,806 functions. The entry point (0x00420577) follows the standard AutoItSC bootstrap pattern: initialize the interpreter heap (fcn.00420a30), parse command-line arguments, locate the embedded script resource, decrypt it in-memory, and transfer control to the script engine. ^[r2:entry0]

The main function at 0x00401c60 is a near-no-op stub (eax = 0; eax++; return) typical of AutoItSC binaries where the real work happens inside the interpreter runtime, not in compiled C/C++ code. ^[r2:main]

No meaningful Ghidra decompilation was attempted — the AutoIt runtime is ~600 KB of MSVC C++ boilerplate and the threat logic lives entirely in the encrypted script.

C2 Infrastructure

No plaintext C2 strings recovered. The AutoItSC runtime imports both WinInet and WinSock APIs, giving the compiled script dual HTTP/FTP and raw TCP/UDP socket capability, but the actual C2 endpoints are runtime-resolved inside the encrypted script payload.

Interesting Tidbits

• British English locale: VS_VERSIONINFO LangID 080904B0 (English, United Kingdom) combined with the ENQUIRY spelling (Commonwealth, not American INQUIRY) suggests targeting of UK/Commonwealth procurement desks. ^[pefile.txt:260]
• Timestamp fidelity: The Aug 2024 build timestamp is genuine (not fabricated to Jan 2012 like siblings e5647a2d, f346b7e9, 941a189b). This indicates either a fresh build or a builder that does not apply timestamp forgery.
• PCRE regex runtime: The full PCRE error-message table and Unicode script-name table are present in .rdata (lines 569–760 of strings.txt), confirming the AutoIt interpreter's regex engine is intact and available to the script. ^[strings.txt:569]
• No shellcode strings in plaintext: Unlike siblings 4de51fe0, 763ae850, and 6718622d where decoded script fragments revealed shellcode staging API names (DllCallAddress, VirtualAlloc) and payload filenames (camellin, Esher, totten), this sample's strings surface is entirely runtime — the script is encrypted and the outer PE contains only AutoIt interpreter boilerplate.

How To Mess With It (Homelab Replication)

To produce a comparable binary:

1. Install AutoIt v3.3.8.1 or later on a Windows research VM.
2. Write a .au3 script with FileInstall, InetRead, or TCPConnect APIs.
3. Compile with Aut2Exe (right-click → Compile Script) or Aut2Exe.exe /in script.au3 /out RFQ.exe.
4. Verify: file.exe should report PE32 executable (GUI) Intel 80386.
5. Verify: Resource Hacker or pefile should show RT_RCDATA ID=SCRIPT with AU3!EA06 header.
6. Run capa — should hit the AutoIt limitation warning identical to this sample.

Deployable Signatures

YARA Rule

rule autoitsc_singlefile_pe32_rfq_lure {
    meta:
        description = "AutoItSC single-file PE32 with RFQ/ENQUIRY_ORDER tracking-code lure"
        author = "PacketPursuit"
        date = "2026-07-13"
        sha256 = "3f3540e185b31c70a7c89bfa8699a34e4c0e19a954a12597ea07791ccdb851d1"
    strings:
        $autoit_header = { A3 48 4B BE 98 6C 4A A9 99 4C 53 0A 86 D6 48 7D }
        $au3_marker = "AU3!EA06"
        $pcre_err1 = "numbers out of order in {} quantifier"
        $pcre_err2 = "unmatched parentheses"
        $wininet = "WININET.dll"
        $wsock32 = "WSOCK32.dll"
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        $autoit_header and
        $au3_marker and
        2 of ($pcre_err*) and
        $wininet and
        $wsock32 and
        filesize < 2MB
}

Behavioral Fingerprint

This binary loads the full AutoIt v3 interpreter (~600 KB of MSVC C++ runtime), imports WinInet, WinSock, ADVAPI32, GDI32, MPR, and PSAPI in a single PE32 x86 executable with 5 sections. Within 5 seconds of process launch, it decrypts a compiled script from RT_RCDATA ID=SCRIPT and begins executing AutoIt bytecode. Network connections (if any) are initiated from the AutoIt script runtime, not from the outer PE's main thread. No child processes are spawned by the outer binary — all behavior is contained within the interpreter.

IOC List

Detection Signatures

References

• Entity page: unclassified-autoit-compiled
• Concept page: autoit-compiled-script-dropper
• Analysis source: raw/analyses/3f3540e185b31c70a7c89bfa8699a34e4c0e19a954a12597ea07791ccdb851d1/
• Artifact ID: 5ec553b8-f6f1-410d-90da-f71beb826a93

Provenance

Analysis derived from file.txt, pefile.txt (pypinfo 2024.x), strings.txt (strings -a -n 6), rabin2-info.txt (radare2 5.x), capa.txt (flare-capa 7.x with AutoIt limitation warning), and radare2 decompilation (entry0 and main). No CAPE detonation available (no Windows guest). Static-only.