unclassified-autoit-compiled: 68e48a8c — UPX-packed transport variant of salary-package .com masquerade

Executive Summary

UPX-packed AutoItSC single-file PE32 (yoursalarypackage.com) that unpacks to an identical SHA-256 as sibling 891df280. This is the thirty-third confirmed sibling in the unclassified-autoit-compiled cluster, and the third confirmed UPX-packed duplicate after c310cb2e→e5647a2d. Static-only analysis (no CAPE Windows guest).

What It Is

Build fingerprint matches the unclassified-autoit-compiled cluster exactly: AutoIt v3 single-file compiler output, AU3!EA06 header, full PCRE regex runtime strings, 18-DLL import surface, empty VS_VERSIONINFO, and the characteristic .com extension salary-package masquerade. ^[strings.txt] ^[pefile.txt]

How It Works

The binary is a UPX-compressed transport layer over the already-analysed plain PE32 891df280. UPX reduces file size from 1.41 MB to 916 KB (64.94% ratio) and adds a minor obfuscation step for static tools that do not unpack before analysis. ^[file.txt]

On execution, the UPX stub decompresses the original AutoItSC runtime in memory, then the embedded AutoIt interpreter decrypts and executes the compiled script bytecode stored as RT_RCDATA in .rsrc. All threat logic (C2 URLs, payload staging, persistence) is sealed inside the encrypted script and not recoverable without decompilation.

Per-sample deltas for 68e48a8c relative to cluster sibling 891df280:

• UPX packing: The only functional delta. Adds a 3-section UPX layout (UPX0, UPX1, .rsrc) with SizeOfRawData=0x0 for UPX0 and high-entropy UPX1 (7.937). ^[pefile.txt]
• Script placement: Same as 891df280 — script lives in .rsrc (RT_RCDATA), not file overlay. ^[binwalk.txt]
• Identical payload: Unpacked SHA-256 matches 891df280 byte-for-byte. No code, resource, or import differences. ^[file.txt]
• YARA hits: PE_File_Generic and Likely_Packer_UPX — generic but accurate. ^[yara.txt]

Decompiled Behavior

Ghidra was not invoked. AutoItSC binaries are C++ runtime stubs; threat logic lives in the compiled AutoIt script. Decompilation of the script requires an AutoIt decompiler (e.g., MyAut2Exe) and is outside the scope of this static-only dive. For decompiled behavior of the unpacked payload, see the report for sibling 891df280. ^[/intel/analyses/891df2806ea7064a2c2c206d6990fb18f8749bb556be5e43af9361f73fd814a0.html]

C2 Infrastructure

No C2 indicators recovered statically. The AutoItSC runtime imports WinInet (HTTP/FTP) and WinSock (TCP/UDP) APIs; any C2 URLs, domains, or IPs are runtime-resolved from the compiled bytecode. ^[pefile.txt] ^[strings.txt]

Interesting Tidbits

• Transport-layer duplicate: This sample is bit-for-bit identical to 891df280 after UPX decompression. The attacker repacked the same payload with UPX, likely to evade signature-based detection that flags on section names or entropy. ^[file.txt]
• .com extension social engineering: Reads as a domain name rather than an executable. A victim scanning email attachments may mentally parse this as a website link. ^[metadata.json]
• Empty version info: VS_VERSIONINFO structurally present but all fields zeroed — consistent cluster trait. ^[pefile.txt]
• PCRE regex library: Full Perl Compatible Regular Expressions error-message table present in .rdata, confirming the AutoIt runtime ships PCRE for script-side regex. ^[strings.txt]
• capa limitation: Mandiant capa correctly identifies UPX packing and declines further static analysis. ^[capa.txt]

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PE32_UPX_Transport
{
    meta:
        description = "AutoIt v3 single-file compiled PE32 with UPX transport layer"
        author = "pp-hermes"
        date = "2026-07-03"
        hash = "68e48a8c19e8d95c80445e5d6290802a6c69ba25d0b020789ddec0983f23a832"
    strings:
        $au3_hdr = "AU3!EA06" ascii
        $pcre_err1 = "numbers out of order in {} quantifier" ascii
        $pcre_err2 = "number too big in {} quantifier" ascii
        $pcre_err3 = "missing terminating ] for character class" ascii
        $pcre_err4 = "regular expression is too large" ascii
        $pcre_err5 = "failed to get memory" ascii
        $wininet1 = "InternetOpenW" ascii
        $wininet2 = "HttpSendRequestW" ascii
        $autoit_str = "This is a third-party compiled AutoIt script." ascii
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        uint16(uint32(0x3C)+0x14) == 0x010B and // PE32
        for any i in (0 .. 10) : (pe.sections[i].name == ".rsrc" or pe.sections[i].name == "UPX0" or pe.sections[i].name == "UPX1") and
        2 of ($pcre_err*) and
        1 of ($wininet*) and
        ($au3_hdr or $autoit_str)
}

Sigma Rule

title: AutoItSC Single-File PE32 UPX Transport Execution
status: experimental
description: Detects execution of UPX-packed AutoIt v3 single-file compiled PE32 binaries
author: pp-hermes
date: 2026-07-03
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'yoursalarypackage.com'
        Image|endswith:
            - '.com'
            - '.exe'
    condition: selection
falsepositives:
    - Legitimate AutoIt-compiled administrative tools (rare)
level: medium

IOC List

Behavioral Fingerprint Statement

This binary is a PE32 x86 GUI executable compressed with UPX 4.2.2. It contains three PE sections (UPX0, UPX1, .rsrc) where UPX0 has SizeOfRawData=0. When unpacked, it resolves to a standard 5-section AutoItSC single-file PE32 with a large .rsrc section (>500 KB) containing an encrypted RT_RCDATA resource. It imports eighteen Windows DLLs with heavy WinInet/WinSock networking, ADVAPI32 registry/token manipulation, SHELL32 file operations, and GDI32/UI primitives. The string table contains a complete PCRE regex error-message library and the sentence "This is a third-party compiled AutoIt script." No C2 strings are visible statically; network behavior is runtime-resolved from the compiled script bytecode. The binary is unsigned and carries an empty VS_VERSIONINFO block.

Detection Signatures

References

• Entity page: unclassified-autoit-compiled
• Unpacked sibling report: /intel/analyses/891df2806ea7064a2c2c206d6990fb18f8749bb556be5e43af9361f73fd814a0.html
• Concept: autoit-compiled-script-dropper
• Source: MalwareBazaar / OpenCTI (artifact f3860a8e-f09d-421c-bf73-6a52fcf47a8d)

Provenance

Analysis based on static artifacts in raw/analyses/68e48a8c.../ generated by:

• file v5.44 (file.txt)
• exiftool v12.76 (exiftool.json)
• pefile Python module (pefile.txt)
• strings (strings.txt)
• capa v8.0.1 (capa.txt)
• rabin2 v5.9.8 (rabin2-info.txt)
• binwalk v2.3.2 (binwalk.txt)
• yara v4.5.0 (yara.txt)
• upx v4.2.2 (unpack verification)

CAPE sandbox detonation was skipped due to no available Windows guest machine. All behavioral claims are inferred from imports and static strings.