unclassified-autoit-compiled: 54ad2eac — Aviation fuel-spec lure with novel L300YQJRH stride-3 hex decoder

Executive Summary

AutoItSC single-file PE32 dropper (LOI_EN_590_10_PPM_and_Jet_A-1.exe) using an aviation fuel-specification lure. Novel L300YQJRH stride-3 decimal-hex string obfuscation; drops maneuverability/sulfhydric dual payload to %TEMP%; shellcode executes at offset 9136 via DllCallAddress after VirtualAlloc RWX allocation. Inner payload (maneuverability, 268 KB, entropy 7.91) not recoverable statically. Forty-first confirmed sibling in the unclassified-autoit-compiled cluster. Static-only (CAPE skipped — no Windows guest). ^[file.txt] ^[capa.txt]

What It Is

How It Works

The compiled AutoIt script (extracted via autoit-ripper) contains three components: the script itself (script.au3, 265 KB), an encrypted inner payload (maneuverability, 268 KB), and a hex-encoded shellcode source (sulfhydric, 89 KB). ^[autoit-ripper:script.au3] ^[autoit-ripper:maneuverability] ^[autoit-ripper:sulfhydric]

Execution chain:

1. Timing gate (K31ACLA(500)): calls kernel32.dll!GetTickCount, sleeps via kernel32.dll!Sleep, checks delta. If the elapsed time is outside (delta + 500) >= 500 && (delta + 4294966796) <= 500, the script exits. This defeats sandboxes that patch or skip Sleep calls. ^[script.au3:9-18]
2. Payload staging: FileInstall("maneuverability", @TempDir & "\maneuverability") and FileInstall("sulfhydric", @TempDir & "\sulfhydric"). ^[script.au3:20-21]
3. Shellcode preparation: Opens sulfhydric via CreateFileW (GENERIC_READ), reads file size via GetFileSize, allocates a byte[] buffer of that size, reads the file contents into it. ^[script.au3:22-28]
4. Decoding: The raw file bytes are passed through BinaryToString, then through L300YQJRH(...) — a stride-3 decimal-hex decoder that takes every first two characters from each 3-character group and interprets them as hex bytes. Example: "6BF65W72B" → 0x6B, 0x65, 0x72 → "ker" (part of "kernel32.dll"). ^[script.au3:31]
5. Execution: VirtualAlloc with flAllocationType = 0x3000 (MEM_COMMIT|MEM_RESERVE) and flProtect = 0x40 (PAGE_EXECUTE_READWRITE); decoded shellcode copied in; DllCallAddress("event", alloc_base + 9136). ^[script.au3:32-35]

The shellcode at offset 9136 will decrypt maneuverability (268 KB, entropy 7.91, high-entropy blob with no recoverable PE header) and transfer execution to the decrypted inner payload. The decryption key and exact algorithm are not recoverable statically.

Novel obfuscation: L300YQJRH stride-3 hex decoder

This sample introduces a new string-obfuscation function not seen in prior siblings. The pattern:

Func L300YQJRH($W30HEPV)
    Local $Y311J = ""
    For $H32YUIB = 1 To StringLen($W30HEPV) Step 3
        Local $R34K1T = StringMid($W30HEPV, $H32YUib, 2)
        $Y311J &= Chr(Dec($R34k1t))
    Next
    Return $Y311J
EndFunc

Every 3rd character is noise (a decimal digit 0-9). The decoder consumes 2 hex chars, skips 1 noise char, repeats. Decoded strings include: kernel32.dll, GetTickCount, sleep, long, dword, ptr, str, 0x3000, 0x40. ^[script.au3:1-8] ^[script.au3:decoded-strings]

This is distinct from the Caesar-shift decoders (W30gfpz1, M31UY3G0) and permutation-XOR (T30WL8ASV) seen in earlier siblings. The stride-3 pattern with decimal noise is novel to this sample.

Decompiled Behavior

No Ghidra/radare2 deep-decompile required — the threat logic lives in the AutoIt script, which autoit-ripper successfully extracted. The C++ runtime (AutoItSC interpreter) is standard: MSVC 14.16, main() sets up the interpreter, loads the compiled script from .rsrc, and executes it. The imports are the full AutoIt runtime surface: WinInet, WinSock, ADVAPI32, GDI32, COMCTL32, etc. ^[pefile.txt:274-501]

C2 Infrastructure

No plaintext C2 strings recovered. The inner payload (maneuverability) is encrypted and its network surface is opaque without dynamic execution or key recovery. Based on cluster behavior (siblings 6718622d, b017d189), the inner payload is likely an AgentTesla-style infostealer with SMTP/HTTP exfil. Static-only inference.

Interesting Tidbits

• Aviation lure: LOI_EN_590_10_PPM_and_Jet_A-1.exe masquerades as a Limiting Oxygen Index (LOI) specification document for Jet A-1 aviation fuel — a highly technical, niche target that signals industrial/engineering-sector targeting rather than generic business-document lures. ^[triage.json]
• Offset 9136: The DllCallAddress jump offset is 9136 (decimal), distinct from the 0x23B0 (9136 in hex, coincidentally the same value) seen in most prior siblings. This may be a compiler artifact or deliberate variation. ^[script.au3:35]
• Payload naming: maneuverability (encrypted inner payload) and sulfhydric (shellcode source) continue the biological/lexical nonce naming convention observed across the cluster (ambiparous, Esher, camellin, totten, emboweling, Lityerses, endochylous, contrapose, Hymenophyllaceae, isochronally, Nasalis). ^[autoit-ripper:maneuverability] ^[autoit-ripper:sulfhydric]
• Empty VS_VERSIONINFO: Same minimal version resource as the rest of the cluster — no masquerade metadata beyond the filename. ^[pefile.txt:229-272]
• Non-UPX: Unlike siblings 498f7bf3 and 68e48a8c, this sample is plain (non-UPX), keeping the PE32 structure simple for analysis but making the .rsrc script immediately visible. ^[file.txt]

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1+ (or latest), compiled with Aut2Exe on Windows.

Reproduction sketch:

1. Write an AutoIt script with a Func L300YQJRH($s) decoder as shown above.
2. Encode API names and strings using the stride-3 pattern: for each byte, write its 2-digit hex value, append a random decimal digit (0-9), repeat. Example: "kernel32.dll" → "6BF65W72B6EY65R6CF33I32Y2EC64G6CF6CZ".
3. Embed a hex-encoded shellcode blob (Caesar-1 or plain hex) as a FileInstall resource.
4. Use DllCallAddress at offset 9136 after VirtualAlloc RWX.
5. Compile with Aut2Exe → single-file PE32.

Verification: Run capa on the compiled PE. It should flag "autoit file limitation" and "compiled with AutoIt". Compare strings output for AU3!EA06 header and PCRE regex error-message table.

Deployable Signatures

YARA rule

rule AutoItSC_L300YQJRH_Stride3_HexDecoder {
    meta:
        description = "AutoItSC dropper with L300YQJRH stride-3 hex decoder and maneuverability/sulfhydric payloads"
        author = "pp-hermes"
        date = "2026-07-10"
        sha256 = "54ad2eac7f23adb2cd0e9c6f287268a66679e3c3e18009d5b59dcb3485a19fc6"
    strings:
        $au3_header = "AU3!EA06" ascii
        $func_name = "L300YQJRH" ascii wide
        $payload1 = "maneuverability" ascii wide
        $payload2 = "sulfhydric" ascii wide
        $dllcall_addr = "DllCallAddress" ascii wide
        $virtualalloc = { 64 77 6F 72 64 }  // "dword" in decoded strings
        $gettickcount = { 47 65 74 54 69 63 6B 43 6F 75 6E 74 }  // "GetTickCount"
    condition:
        uint16(0) == 0x5A4D and
        $au3_header and
        $func_name and
        any of ($payload*) and
        filesize < 2MB
}

Behavioral fingerprint

This binary is a compiled AutoIt3 single-file PE32 (non-UPX) with an empty VS_VERSIONINFO. At runtime it drops two files to %TEMP% named with biological/lexical nonce words (e.g., maneuverability, sulfhydric). It allocates RWX memory via VirtualAlloc with flAllocationType = 0x3000 and flProtect = 0x40, copies decoded shellcode into it, and executes at a fixed offset (typically 0x23B0 or 9136) via DllCallAddress. The shellcode decrypts a larger encrypted payload (200-300 KB) using a stack-built XOR key, then reflectively loads it. Network C2 is not visible statically and is resolved at runtime by the inner payload.

IOC list

Detection Signatures

References

• Artifact ID: 40cea629-3dc1-427f-8b47-155fbed10ce0
• Source: MalwareBazaar (abuse.ch)
• Family entity: unclassified-autoit-compiled — forty-one confirmed siblings
• Related technique: autoit-stride3-hex-decoder — L300YQJRH stride-3 decimal-hex string obfuscation
• Related concept: autoit-compiled-script-dropper — compiled AutoIt deployment patterns

Provenance

• file.txt — file output, PE32 x86 GUI, 5 sections
• pefile.txt — pefile.py full header dump, MSVC 14.16 linker, Aug 2024 timestamp
• strings.txt — ASCII/Unicode strings, AU3!EA06 header at line 2017
• capa.txt — Mandiant capa v7, "autoit file limitation" and "compiled with AutoIt"
• autoit-ripper v1.2.0 — extracted script.au3, maneuverability, sulfhydric
• floss.txt — not applicable (AutoIt-compiled, capa limitation)
• dynamic-analysis.md — CAPE skipped, no Windows guest available