> Analysis · 708485983114_

~/packetpursuit $ cat /intel/analyses/708485983114.../report.md

typedeep-analysisfamilyunattributedcreated2026-07-05
SHA-256: 708485983114d04a0e498dac08fb74e0c7033a6af892d807f939d9801a59348f

Deep Analysis: 708485983114d04a0e498dac08fb74e0c7033a6af892d807f939d9801a59348f

Build / RE

Toolchain: Compiled AutoIt3 single-file executable (PE32, x86). The outer binary is the AutoIt3 interpreter with the compiled .a3x script embedded in resource type 10 (SCRIPT). ^[file.txt]

Packing / Obfuscation: Two layers:

  1. AutoIt script obfuscation — string literals are hex-encoded and split across hundreds of concatenation lines ($PBDWLMZ &= "…"). A delimiter 0qk5dd92 is inserted between every hex digit; the QATYOALFNE function strips it to recover the original string. ^[script.au3:885-1290]
  2. Shellcode payload — 14,336 bytes of x86 position-independent shellcode embedded in the deobfuscated $PBDWLMZ variable. No PE header; executed via CallWindowProc. ^[shellcode.bin]

API Resolution: The shellcode resolves Win32 APIs dynamically via PEB walking (fs:[0x30] → Ldr → InLoadOrderModuleList) and a CRC32-based export hash lookup (fcn.0x000034c0 and fcn.0x00003520). ^[shellcode_disasm.txt]

Anti-Analysis: Minimal — no VM checks, no debug detection. The obfuscation is purely string-level; the shellcode itself is straightforward position-independent code.

Secondary Payload: The shellcode reads %TEMP%\Sancha, XOR-decrypts it with key 51AHC0R0YXO (11-byte repeating XOR), and loads the result as a PE. The decrypted file is a 288 KB PE32 (x86) compiled Sun Apr 9 2017 06:16:38 UTC, fully static, position-independent, with a single .text section and an entropy of 7.96. ^[decrypted_zyvp.bin]

Notable Functions:

  • fcn.000022e0 — XOR decrypt: buf[i] ^= key[i % key_len].
  • fcn.000025b0 — PE loader: reads file, maps with VirtualAlloc, relocates, resolves imports, executes via CreateProcessW with CREATE_SUSPENDED + NtQueueApcThread or thread-hijack pattern.
  • fcn.000034c0 — PEB walker for module resolution.
  • fcn.00003520 — Export table hash lookup.

Deploy / ATT&CK

TTPs (static inference, no dynamic execution available):

Technique ID Evidence
User Execution T1204.002 Masquerades as shipping document (Re_HAWB_no._#SHKGA0004506.exe). ^[triage.json]
Obfuscated Files or Information T1027 Hex-split payload with delimiter stripping (0qk5dd92). ^[script.au3:885-1290]
Process Injection T1055.001 CallWindowProc used to transfer control to shellcode at DllStructGetPtr($PARATIM) + 9136. ^[script.au3:1295]
VirtualProtect T1055 Shellcode memory is marked RWX before execution. ^[script.au3:1294]
Reflective Code Loading T1620 Position-independent shellcode loads a second PE from disk into memory and executes it. ^[shellcode_disasm.txt]
XOR Decryption T1027.001 Secondary payload encrypted with 11-byte key 51AHC0R0YXO. ^[shellcode_disasm.txt @ 0x22e0]
File Write to Temp T1078 Writes encrypted payload to %TEMP%\Sancha. ^[script.au3:1288-1290]

Persistence: None observed in static analysis. The shellcode does not touch the registry or startup folders.

C2 / Network: No network indicators recovered from any layer. No URLs, IPs, or domain strings in the outer binary, shellcode, or decrypted secondary payload. Suspicious_Wininet_Imports YARA hit on the outer binary is a false positive from the AutoIt runtime. ^[yara.txt]

Attribution: None. The toolchain (AutoIt3, MSVC 14-ish circa 2017 for the secondary payload) and the XOR key 51AHC0R0YXO are not linked to any tracked family. Filename theme (HAWB = House Air Waybill) is generic shipping lure.

Artifacts

  • shellcode.bin — 14,336 bytes of x86 PIC extracted from $PBDWLMZ.
  • decrypted_zyvp.bin — 288 KB PE32 secondary payload, SHA-256 53bec2d12b0fdb40bf462d3f06f15cf6dddc71b55fb8e23e0edb020370b87ba9.
  • autoit-extracted/script.au3 — decompiled AutoIt source (5,348 lines, ~975 KB).