unclassified-autoit-compiled: 561c3ff6 — DHL airway-bill + invoice hybrid lure, 352 KB SCRIPT in .rsrc

Executive Summary

AutoItSC v3.3.8.1 single-file PE32 with a DHL airway-bill / invoice hybrid social-engineering lure (DHLXINVX0914534XPDF.exe). Script stored in .rsrc RT_RCDATA (352 KB, encrypted AU3!EA06 header). Standard AutoItSC import surface, 11-icon suite, empty VS_VERSIONINFO, British English LangID. No plaintext C2, payload filenames, or shellcode strings recovered statically. No CAPE detonation (no Windows guest). Fifty-seventh confirmed sibling in the cluster.

What It Is

How It Works

This sample is a fifty-seventh confirmed sibling of the unclassified-autoit-compiled AutoItSC single-file PE32 cluster. The threat logic is entirely contained within the encrypted AutoIt script stored in .rsrc; the outer PE is the standard AutoItSC v3.3.8.1 interpreter/runtime. For shared cluster characteristics — toolchain, import surface, PCRE regex runtime, social-engineering patterns — see unclassified-autoit-compiled.

Per-sample deltas:

• Filename: DHLXINVX0914534XPDF.exe — a hybrid DHL airway-bill + invoice lure with embedded tracking code 0914534 and XPDF suffix suggesting a PDF masquerade. This is the second DHL-themed sibling after f618a861 (DHL_AWB_TRACKING_DETAILS.exe, Jul 2024) and the third logistics-themed sibling after 941a189b (logistics tracking code) and dca60b6b (COMMECIAL_INVOICE_AND_DHL_AWB_TRACKING_DETAILS.exe). ^[triage.json]
• Script size: 352,163 bytes — mid-range for the cluster (smallest: 183 KB cca7d56d; largest: 932 KB f0059bee).
• Icon suite: 11 RT_ICON entries across 4 RT_GROUP_ICON groups (IDs 99, 162, 164, 169) — a rich icon set, above the cluster median of 4 icons. ^[terminal: python icon count]
• Build timestamp: Genuine Dec 2024 timestamp (not the fabricated Jan 2012 seen in overlay-placement siblings). This extends confirmed cluster activity into December 2024. ^[pefile.txt]
• Script placement: .rsrc RT_RCDATA (standard for cluster), not file overlay. The AU3!EA06 header is found at raw offset 0x12DB53 (0xD7BC6 area) with a 16-byte prefix (fe 1b 0f 6d 11 bf 21 0f 8e a2 1e 7f 20 31 41 1f) before the marker — a pattern also observed in sibling e08d5bcef. ^[terminal: xxd]
• No UPX packing: Plain PE32 (non-UPX), 5 sections including .reloc. ^[pefile.txt]

The encrypted script is opaque to static analysis. No AutoIt decompiler output was generated; the script would require MyAut2Exe or Exe2Aut with the correct decryption key to recover plaintext source.

Decompiled Behavior

Ghidra/radare2 analysis of the outer PE is unproductive — the .text section is the standard AutoItSC v3.3.8.1 C++ interpreter runtime (MSVC 14.16). Capa correctly identifies the sample as AutoIt-compiled and aborts with a limitation warning: "capa cannot handle AutoIt scripts." ^[capa.txt]

The interpreter's entry point (0x420577) initializes the AutoIt runtime, loads the encrypted script from .rsrc, decrypts it in-memory, and begins bytecode execution. No meaningful function-level decompilation of threat logic is possible without first recovering the script source.

C2 Infrastructure

No C2 indicators recovered statically. The AutoItSC import table includes WinInet/WinSock/IPHLPAPI networking APIs, confirming the runtime has network capability, but no hardcoded URLs, IPs, domains, mutex names, or payload filenames were found in plaintext strings. ^[strings.txt] Threat logic — including C2 endpoints, payload staging, and persistence — is encrypted inside the compiled script.

Interesting Tidbits

• The filename DHLXINVX0914534XPDF.exe concatenates "DHL", "INV" (invoice), "X" (cross/airway-bill), a numeric tracking code 0914534, and "XPDF" (suggesting a PDF file). This is a multi-theme social-engineering lure combining logistics and finance urgency. ^[triage.json]
• The 16-byte prefix before the AU3!EA06 header at raw offset 0x12DB53 is identical in structure to the prefix observed in sibling e08d5bcef (overlay placement), suggesting a common build tool or script packager across both .rsrc and overlay placement variants. ^[terminal: xxd]
• British English LangID (080904B0) is consistent with the cluster's strong Commonwealth English targeting pattern. All siblings with non-empty version info use this LangID. ^[pefile.txt]
• The .rsrc section entropy of 7.90 is near-maximum, consistent with encrypted script content. No secondary payload blobs, shellcode stubs, or companion file indicators were found in the outer binary. ^[pefile.txt]

How To Mess With It (Homelab Replication)

Not directly applicable — the threat logic is inside the encrypted AutoIt script, not the outer PE. To replicate the outer shell:

1. Download AutoIt v3.3.8.1 and Aut2Exe compiler
2. Write an AutoIt script that drops/executes a payload
3. Compile with Aut2Exe to a single-file PE32
4. Verify: strings should show AU3!EA06, PCRE error messages, and the standard AutoItSC import surface
5. Capa should hit the (internal) autoit file limitation rule

For the inner threat logic, you would need to decompile the script (see MyAut2Exe) or detonate in a sandbox with AutoIt logging enabled.

Deployable Signatures

YARA Rule

rule autoitsc_singlefile_dhl_lure : malware {
    meta:
        description = "AutoItSC v3.3.8.1 single-file PE32 with DHL/invoice social-engineering lure"
        author = "PacketPursuit"
        date = "2026-07-22"
        hash = "561c3ff6b268566497a4e74bd61eed2058682100d2dfc9bb0e1edf78e743d3f0"
    strings:
        $autoit_header = "AU3!EA06" ascii
        $autoit_text = ".text$lp00AutoItSC" ascii
        $pcre_err1 = "numbers out of order in {} quantifier" ascii
        $pcre_err2 = "PCRE does not support \\L, \\l, \\N{name}, \\U, or \\u" ascii
        $pcre_err3 = "regular expression is too large" ascii
        $dhl_lure1 = "DHLXINVX" ascii wide nocase
        $dhl_lure2 = "DHL_AWB_TRACKING_DETAILS" ascii wide nocase
        $dhl_lure3 = "COMMECIAL_INVOICE_AND_DHL_AWB" ascii wide nocase
        $wininet = "WININET.dll" ascii
        $iphlpapi = "IPHLPAPI.DLL" ascii
        $icmp1 = "IcmpSendEcho" ascii
        $icmp2 = "IcmpCreateFile" ascii
    condition:
        uint16(0) == 0x5A4D and
        $autoit_header and
        $autoit_text and
        (2 of ($pcre_err*)) and
        $wininet and
        $iphlpapi and
        (1 of ($dhl_lure*) or
         (pe.imports("IPHLPAPI.DLL", "IcmpSendEcho") and
          pe.imports("IPHLPAPI.DLL", "IcmpCreateFile") and
          pe.imports("WININET.dll") and
          pe.sections[3].name == ".rsrc" and
          pe.sections[3].characteristics & pe.SECTION_MEM_READ))
}

Sigma Rule

title: AutoItSC Single-File PE32 Execution with Network Imports
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith:
            - '\\DHLXINVX*.exe'
            - '\\DHL_AWB_TRACKING_DETAILS.exe'
            - '\\COMMECIAL_INVOICE_AND_DHL_AWB_TRACKING_DETAILS.exe'
            - '\\INVOICE.exe'
            - '\\RFQ*.exe'
            - '\\PURCHASE_ORDER*.exe'
    condition: selection
falsepositives:
    - None known for these exact filenames
level: high

IOC List

Behavioral Fingerprint

This binary is an AutoItSC v3.3.8.1 single-file PE32 with the interpreter runtime and encrypted script fused into one executable. It loads KERNEL32.DLL, ADVAPI32.dll, COMCTL32.dll, COMDLG32.dll, GDI32.dll, IPHLPAPI.DLL, MPR.dll, ole32.dll, OLEAUT32.dll, PSAPI.DLL, SHELL32.dll, USER32.dll, USERENV.dll, UxTheme.dll, VERSION.dll, WININET.dll, WINMM.dll, and WSOCK32.dll. The .rsrc section is high-entropy (~7.9) and contains an encrypted SCRIPT resource with AU3!EA06 header. At runtime, the interpreter decrypts and executes the compiled AutoIt bytecode, which typically performs file-system staging, process injection, or C2 beaconing. No anti-debug or VM checks are present in the outer runtime.

Detection Signatures

References

• MalwareBazaar artifact: 26059cb3-e73d-428a-8915-228e0c93e469
• Cluster entity page: unclassified-autoit-compiled
• Sibling f618a861 — first DHL-themed sibling: DHL_AWB_TRACKING_DETAILS.exe ^[/intel/analyses/f618a8619ab45629df06d80a6d5fec78962a679dbaaca29cf51cf9261973486f.html]
• Sibling dca60b6b — combined commercial invoice + DHL lure ^[/intel/analyses/dca60b6ba188e4f8886afd5002c8a4ab49e27f70e0c81dafa4cb3bbecfb3b38a.html]
• Sibling 941a189b — logistics tracking-code lure ^[/intel/analyses/941a189bd84102c13255835bb2f4df77d9cb126be4e54faa179b9de469375fbe.html]

Provenance

Analysis based on:

• file.txt — file command output (PE32 executable, 5 sections)
• exiftool.json — ExifTool PE metadata (linker 14.16, timestamp 2024-12-18)
• pefile.txt — pefile parser output (sections, imports, VS_VERSIONINFO, resource directory)
• strings.txt — strings -n 4 output (AutoIt markers, PCRE messages, import names)
• capa.txt — Mandiant capa v8.1.0 (AutoIt limitation warning)
• rabin2-info.txt — radare2 binary header (unsigned, canary true, PIC)
• binwalk.txt — binwalk scan (CRC32 polynomial table at 0xC2640, no embedded archive)
• yara.txt — YARA matches (PE_File_Generic, Suspicious_Wininet_Imports)
• triage.json — triage metadata (filename, artifact ID, OpenCTI labels)
• Terminal commands: pefile resource enumeration, xxd hex dumps, icon count, overlay check

Sample was not detonated in CAPE (no Windows guest available). All behavior inferences are static-only and rely on the known AutoItSC malware patterns documented in the cluster entity page.