unclassified-autoit-compiled: 5833e797 — 1.11 MB SCRIPT resource, YASREF refinery engineering-document lure

Executive Summary

AutoItSC v3.3.8.1 single-file compiled PE32 (1.93 MB) with a 1.11 MB encrypted SCRIPT resource — the largest in the corpus cluster to date. Industrial social-engineering lure masquerades as a Yanbu Aramco Sinopec Refinery (YASREF) engineering document with exact PE build timestamp matching the claimed date (17-Sep-2024). Empty VS_VERSIONINFO, full WinInet/WinSock/ADVAPI32 import surface. No static C2 recovered; threat logic lives entirely inside the encrypted AutoIt bytecode. Static-only analysis.

What It Is

• PE32 executable (GUI) x86, 5 sections, MSVC 12.0 linker (VS 2013) ^[file.txt] ^[exiftool.json]
• Compiled Tue 17 Sep 2024 00:21:16 UTC — matches filename date exactly ^[rabin2-info.txt]
• AutoItSC v3.3.8.1 single-file compiler output; capa flagged AutoIt limitation immediately ^[capa.txt]
• 1.11 MB (0x10FA30 byte) encrypted SCRIPT resource in .rsrc RT_RCDATA ID=SCRIPT ^[pefile.txt:1514]
• Empty VS_VERSIONINFO (StringFileInfo ValueLength=0) ^[pefile.txt:253]
• Four-icon suite in .rsrc (IDs 0x63, 0xA2, 0xA4, 0xA9) ^[pefile.txt:1529]
• Full PCRE regex runtime embedded (error strings + Unicode script-name table) ^[strings.txt:625]
• Unsigned, no PDB, no Authenticode ^[pefile.txt]

How It Works

The binary is the AutoIt v3 interpreter runtime fused with a compiled/encrypted AutoIt script. On execution, the runtime extracts the SCRIPT resource from .rsrc, decrypts it in-memory, and executes the bytecode. All malicious behavior (payload staging, C2, persistence) is therefore opaque to static analysis without decompilation. The interpreter's import table provides the full Win32 API surface the script can call: process creation, registry writes, file operations, network sockets, HTTP/FTP, ICMP, and GDI screen capture ^[pefile.txt].

This sample is a cluster sibling of the unclassified-autoit-compiled family. It differs from prior siblings in three ways: (1) the SCRIPT resource at 1.11 MB is the largest observed in the cluster; (2) the MSVC 12.0 linker (VS 2013) is older than the 14.x dominant in recent siblings; (3) the industrial engineering lure targets oil-and-gas infrastructure procurement rather than generic invoice/payment themes.

Decompiled Behavior

Ghidra / pyghidra was not executed — capa correctly identified the AutoIt runtime limitation and advised manual decompilation with MyAut2Exe ^[capa.txt]. The threat logic lives in encrypted AutoIt bytecode inside the .rsrc SCRIPT resource; native disassembly of the interpreter runtime does not reveal payload behavior.

C2 Infrastructure

No C2 indicators recovered statically. The encrypted SCRIPT resource prevents string extraction of URLs, IPs, or domains. WinInet and WinSock imports indicate network capability; actual C2 endpoints are runtime-resolved by the script. ^[pefile.txt]

Interesting Tidbits

• The filename references "YASREF-318-CJ_G1-61_Phase_1D-BCD" — YASREF (Yanbu Aramco Sinopec Refinery Company) is a real Saudi refinery. The alphanumeric codes suggest procurement/engineering specificity designed to bypass casual inspection. ^[triage.json]
• PE build timestamp 2024-09-17 00:21:16 UTC matches the filename's "17th-September-2024" exactly, reinforcing temporal plausibility. ^[rabin2-info.txt] ^[exiftool.json]
• MSVC 12.0 linker (VS 2013) is a toolchain regression compared to the VS 2017/2019 used by most Jul–Sep 2024 siblings; possible reuse of an older build environment or deliberate toolchain diversity. ^[exiftool.json]
• The 1.11 MB SCRIPT resource exceeds the prior cluster maximum of 932 KB (sample f0059bee), making this the largest script payload in the corpus. ^[pefile.txt:1514]
• AutoIt error strings 5000–5004 ("Unable to parse line", "Unable to open the script file", etc.) are present in .rsrc RT_STRING, confirming the interpreter's diagnostic surface is intact. ^[pefile.txt:1480]

How To Mess With It (Homelab Replication)

To replicate the AutoItSC compilation fingerprint:

1. Install AutoIt v3.3.8.1+ from autoitscript.com
2. Write a benign AutoIt script that uses InetGet, RegWrite, FileWrite, and DllCall
3. Compile with Tools → Compile Script (x86) → Options → "Use x86 tools instead of x64"
4. Verify output is PE32 GUI with 5 sections and a .rsrc RT_RCDATA resource named SCRIPT
5. Run capa <output.exe> — should flag (internal) autoit file limitation

To extract the encrypted script for study, use autoit-ripper or myAut2Exe on a Windows research VM. The extracted .au3 source will reveal payload staging logic, C2 endpoints, and any custom string-obfuscation functions.

Deployable Signatures

YARA rule

rule autoitsc_singlefile_loader_large_script {
    meta:
        description = "AutoItSC single-file PE32 with large encrypted SCRIPT resource"
        author = "PacketPursuit"
        date = "2026-07-10"
        sha256 = "5833e7971bc43cfc52783e963373bcbec8a219ff406afb0a27f52861380b7b97"
    strings:
        $autoit_marker = "This is a third-party compiled AutoIt script."
        $err_5000 = "5000: Unable to parse line." wide
        $err_5001 = "5001: Unable to open the script file." wide
        $err_102 = "102: AutoIt Error" wide
        $wsock = "WSOCK32.dll" ascii
        $wininet = "WININET.dll" ascii
        $advapi = "ADVAPI32.dll" ascii
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        uint16(uint32(0x3C)+0x14) == 0x10B and
        $autoit_marker and
        2 of ($err_*) and
        $wsock and
        $wininet and
        $advapi
}

Sigma rule

title: AutoIt Compiled Script Execution - Industrial Lure Pattern
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '.exe'
        CommandLine|contains:
            - 'YASREF'
            - 'Manual_Sampling_System'
            - 'Phase_1D'
            - 'BCD_'
    condition: selection
falsepositives:
    - Legitimate engineering documents named similarly (unlikely)
level: high

IOC list

Behavioral fingerprint

This binary is an AutoItSC single-file PE32 interpreter with a large encrypted SCRIPT resource. It imports the full Win32 automation surface (KERNEL32, USER32, GDI32, ADVAPI32, WSOCK32, WININET, IPHLPAPI, MPR, COMCTL32). The VS_VERSIONINFO block is empty. On execution, the interpreter decrypts and runs the embedded AutoIt bytecode, which typically stages a secondary payload to %TEMP% via hex-encoded shellcode and DllCallAddress injection. No static C2 indicators are visible; network endpoints are resolved at runtime by the script.

Detection Signatures

• YARA: Suspicious_Wininet_Imports ^[yara.txt]
• capa: (internal) autoit file limitation — runtime is AutoIt, capa cannot analyze script logic ^[capa.txt]

References

• SHA-256: 5833e7971bc43cfc52783e963373bcbec8a219ff406afb0a27f52861380b7b97
• Filename: Project_Commercial_Terms_And_Conditions_-_For_Manual_Sampling_System-Rev_SSGT_General_Ref_No-YASREF-318-CJ_G1-61_Phase_1D-BCD_17th-September-2024.exe
• Family page: unclassified-autoit-compiled
• Concept: autoit-compiled-script-dropper
• Concept: social-engineering-filename-lure
• MalwareBazaar: https://bazaar.abuse.ch/sample/5833e7971bc43cfc52783e963373bcbec8a219ff406afb0a27f52861380b7b97/

Provenance

Analysis based on file, exiftool, pefile, strings, capa, floss, binwalk, rabin2, and yara outputs captured during triage on 2026-05-26. No dynamic execution available (CAPE skipped — no Windows guest). capa v7 (Flare) flagged AutoIt limitation. floss failed with argument parsing error. All citations reference wiki/wiki/raw/analyses/5833e7971bc43cfc52783e963373bcbec8a219ff406afb0a27f52861380b7b97/.