unclassified-autoit-compiled: 42c82e1d — 659 KB overlay-script AutoItSC with New_Order.exe procurement lure

Executive Summary

Compiled AutoIt v3 single-file PE32 (AutoItSC) with a 659 KB encrypted script stored in the file overlay rather than the usual .rsrc RT_RCDATA placement. Filename New_Order.exe targets procurement departments. No shellcode staging strings, payload filenames, or C2 indicators recovered statically — the threat logic is inside the encrypted AutoIt bytecode. Ninth confirmed sibling in the cluster with overlay script placement. Static-only analysis.

What It Is

The .rsrc section contains only standard AutoIt runtime resources: 4 icons, 1 menu, 1 dialog, 7 string tables (AutoIt error messages), version info, and manifest — but no RT_RCDATA SCRIPT entry ^[pefile.txt:916-1479]. The compiled bytecode lives after the last section in the file overlay, encrypted to near-random entropy. This matches the overlay-placement subgroup within the broader unclassified-autoit-compiled cluster.

How It Works

This is a standard AutoItSC single-file compiler output: the PE carries the full AutoIt v3 interpreter runtime plus the compiled script. At launch the runtime decrypts and executes the bytecode. Because the overlay is encrypted (entropy ~8.0), static analysis cannot recover the script's control flow, C2 endpoints, or payload staging logic without decompilation.

Unlike siblings such as 498f7bf3 (drops ambiparous/Esher dual payload) or 6718622d (drops emboweling/Lityerses with AgentTesla inner payload), no plaintext payload filenames, shellcode decoder names, or C2 strings were recovered in this sample. The script may use identical staging logic (drop to %TEMP%, decrypt via Caesar/XOR hex decoder, VirtualAlloc RWX + DllCallAddress shellcode execution), but this is inferred from cluster behavior, not observed here.

The import table is the full AutoItSC runtime surface and provides the capability envelope:

• Network: WSOCK32 (raw sockets), WININET (HTTP/FTP) ^[pefile.txt:267-368]
• Process manipulation: VirtualAlloc, VirtualAllocEx, WriteProcessMemory, CreateProcessW, OpenProcess, CreateThread ^[pefile.txt:404-533]
• Registry persistence: RegSetValueExW, RegCreateKeyExW, RegOpenKeyExW ^[pefile.txt:796-830]
• Token elevation: OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW ^[pefile.txt:807-826]
• Privilege escalation / impersonation: CreateProcessAsUserW, CreateProcessWithLogonW, LogonUserW ^[pefile.txt:810-816]
• Discovery: EnumProcesses, CreateToolhelp32Snapshot, Process32FirstW/NextW, GetSystemInfo ^[pefile.txt:378-433]
• Collection: GetAsyncKeyState, SendInput, GetClipboardData, SetClipboardData, GDI32 screenshot primitives ^[pefile.txt:643-704] ^[pefile.txt:741-775]
• Evasion: IsDebuggerPresent, GetTickCount, Sleep ^[pefile.txt:521] ^[pefile.txt:557]

Decompiled Behavior

Ghidra analysis of the C++ interpreter runtime was not pursued. The binary is a known AutoItSC v3.3.8.1 single-file compiler output; malicious behavior resides in the encrypted overlay bytecode, not in the interpreter itself. Prior cluster siblings demonstrate that decompilation requires autoit-ripper, MyAut2Exe, or Exe2Aut against the overlay to recover plaintext script logic, payload staging strings, and C2 endpoints.

C2 Infrastructure

C2 obfuscated / runtime-resolved. No plaintext domains, IPs, URLs, mutex names, or named pipes were recovered statically. The encrypted overlay prevents string extraction. Cluster siblings typically stage payloads from hardcoded URLs or download secondary binaries at runtime via WinInet or WinSock APIs inside the AutoIt script.

Interesting Tidbits

• Overlay placement rarity: This is the ninth confirmed sibling in the unclassified-autoit-compiled cluster with the script stored in the file overlay rather than .rsrc RT_RCDATA. Prior overlay siblings: ff84806a, e5647a2d, f346b7e9, d990bd1b, a8beee89, 941a189b, 7768873f, fb5bc543 ^[entities/unclassified-autoit-compiled.md]. Overlay placement breaks autoit-ripper when run without explicit offset arguments.
• Four-section PE: No .reloc section (same as 7768873f). Most AutoItSC outputs have five sections.
• Procurement lure: New_Order.exe fits the cluster's business-document social-engineering pattern (purchase order, invoice, RFQ, quotation).
• Jan 2012 fabricated timestamp: Consistent with cluster-wide timestamp rollback, likely to evade age-based detection.
• No PCRE regex strings in plaintext: Unlike siblings f2be9e06 and f527ce01, the .rsrc string tables here contain only standard AutoIt error messages — no evidence of script-side regex data harvesting.

How To Mess With It (Homelab Replication)

1. Install AutoIt v3.3.8.1 (or latest) from autoitscript.com.
2. Write a simple dropper script using InetRead, FileInstall, or Run to stage a payload.
3. Compile with Aut2Exe (right-click → Compile Script) or AutoItSC command-line.
4. The output will be a PE32 with identical section layout and import surface.
5. Verify with capa — it should emit the AutoIt limitation warning and flag Suspicious_Wininet_Imports.
6. To analyze: extract the overlay with dd if=sample.exe of=script.bin bs=1 skip=$(python3 -c "import pefile; pe=pefile.PE('sample.exe'); print(pe.sections[-1].PointerToRawData + pe.sections[-1].SizeOfRawData)"), then run autoit-ripper or MyAut2Exe against script.bin.

Deployable Signatures

YARA Rule

rule autoitsc_overlay_new_order_42c82e1d
{
    meta:
        description = "AutoItSC single-file PE32 with overlay script placement — New_Order.exe variant"
        author = "PacketPursuit"
        date = "2026-07-13"
        sha256 = "42c82e1d79c735958322ed175e661aee9854ce6436c07e9c6621f2687469b04f"
        family = "unclassified-autoit-compiled"

    strings:
        $autoit_ver = "AutoIt v3 Script: 3, 3, 8, 1" wide
        $au3_hdr = { 41 55 33 21 45 41 30 36 }  // "AU3!EA06"
        $wsock = "WSOCK32.dll" ascii
        $wininet = "WININET.dll" ascii
        $kernel = "KERNEL32.dll" ascii
        $advapi = "ADVAPI32.dll" ascii
        $user32 = "USER32.dll" ascii
        $gdi = "GDI32.dll" ascii
        $oleaut = "OLEAUT32.dll" ascii
        $shell = "SHELL32.dll" ascii

    condition:
        uint16(0) == 0x5A4D and
        pe.characteristics & pe.EXECUTABLE_IMAGE and
        pe.number_of_sections == 4 and
        $autoit_ver and
        $wsock and $wininet and $kernel and $advapi and
        $user32 and $gdi and $oleaut and $shell and
        // script is in overlay, not .rsrc RT_RCDATA
        for any i in (0 .. pe.number_of_resources - 1):
            (pe.resources[i].type != pe.RESOURCE_TYPE_RCDATA) and
        // high-entropy overlay after last section
        filesize > 1MB and
        // AU3 header near end of file
        $au_ hdr in (filesize - 0x1000 .. filesize)
}

Sigma Rule

title: AutoItSC Overlay Script Execution - New_Order.exe Variant
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\\New_Order.exe'
        - Hashes|contains:
            - '42c82e1d79c735958322ed175e661aee9854ce6436c07e9c6621f2687469b04f'
    condition: selection
falsepositives:
    - None expected for this hash
level: critical

IOC List

Behavioral Fingerprint

This binary is a PE32 GUI executable compiled with the AutoIt v3 single-file compiler. It presents a 4-section PE with no .reloc, standard AutoIt runtime imports across 16 DLLs (WSOCK32, WININET, KERNEL32, ADVAPI32, USER32, GDI32, OLEAUT32, ole32, SHELL32, PSAPI, USERENV, MPR, COMCTL32, WINMM, VERSION, COMDLG32), and a 659 KB high-entropy file overlay containing the encrypted compiled script. No malicious strings are visible in the PE body; threat logic is inside the encrypted AutoIt bytecode. Upon execution, the AutoIt interpreter decrypts and runs the script, which typically stages a secondary payload to %TEMP% and executes it via shellcode injection or process hollowing.

Detection Signatures

• capa: AutoIt limitation warning; Suspicious_Wininet_Imports ^[capa.txt]
• YARA: PE_File_Generic ^[yara.txt]
• ATT&CK mapping (inferred from import surface and cluster behavior):
  • T1059.005 — Command and Scripting Interpreter: Visual Basic / AutoIt
  • T1071.001 — Web Protocols (WinInet)
  • T1095 — Non-Application Layer Protocol (WinSock)
  • T1547.001 — Registry Run Keys
  • T1053.005 — Scheduled Task
  • T1083 — File and Directory Discovery
  • T1057 — Process Discovery
  • T1012 — Query Registry
  • T1113 — Screen Capture
  • T1115 — Clipboard Data
  • T1056.001 — Keylogging
  • T1562.001 — Impair Defenses (token manipulation, privilege escalation APIs)

References

• unclassified-autoit-compiled — cluster entity page
• autoit-compiled-script-dropper — concept page for AutoIt deployment patterns
• Cluster sibling 498f7bf3 — shellcode + dual payload staging ^[/intel/analyses/498f7bf34e8e067e036bebc978ab35e74b9a3ef31cc6ff58d8542a2566518e7a.html]
• Cluster sibling 6718622d — AgentTesla inner payload via AutoItSC ^[/intel/analyses/6718622d94d373a123cac9f8cc6789bc1132eed19a5a9232dd0454ee869d910c.html]
• MalwareBazaar: https://bazaar.abuse.ch/sample/42c82e1d79c735958322ed175e661aee9854ce6436c07e9c6621f2687469b04f/

Provenance

Analysis based on:

• file v5.44
• exiftool v12.76
• pefile (Python) — header, sections, imports, resources
• radare2 (rabin2) — binary info
• binwalk v2.3.4 — embedded artifact scan
• strings — ASCII/Unicode string extraction
• capa v9.0.0 — capability detection (AutoIt limitation triggered)
• floss v3.1.0 — failed due to CLI argument error; not re-run
• Custom Python entropy calculation on file overlay

No dynamic analysis performed — CAPE skipped due to no Windows guest available ^[dynamic-analysis.md].