unclassified-autoit-compiled: 7317e559 — Purchase-order lure, Jul 2024 build, 344 KB encrypted SCRIPT in .rsrc

Executive Summary

AutoIt v3 single-file compiled PE32 (AutoItSC) delivered as PURCHASE_ORDER_PO_#_2107-20454_24.exe. The 344 KB encrypted script payload resides in .rsrc (RT_RCDATA); threat logic is opaque without AutoIt decompilation. Thirty-fourth confirmed sibling of the unclassified-autoit-compiled cluster. Same empty VS_VERSIONINFO, PCRE regex runtime, and full WinInet/WinSock/ADVAPI32 import surface as cluster siblings. No plaintext C2 strings recovered. Static-only analysis.

What It Is

Cluster fingerprint: The AU3!EA06 encrypted script header marker appears in .rsrc ^[strings.txt:1299], confirming AutoItSC v3.3.8.1+ single-file compilation. The PCRE regex library error-message table and Unicode script-name list are present in full ^[strings.txt:594–780]. Import table is the standard AutoIt runtime surface: WSOCK32 (full socket API), WININET (HTTP/FTP client), IPHLPAPI (ICMP echo), ADVAPI32 (registry + token privileges), USERENV (profile loading), PSAPI (memory queries), MPR (network drive mapping), COMCTL32 (ImageList GUI), WINMM (multimedia), GDI32/USER32 (screen capture / input simulation) ^[pefile.txt:274–500].

YARA hits: PE_File_Generic (expected), Suspicious_Wininet_Imports ^[triage.json:16] — the latter is notable because the WinInet import surface is deep enough to trigger behavioral YARA even through the AutoIt runtime abstraction.

How It Works

Because the AutoIt script is encrypted/compiled bytecode, the actual execution flow is not recoverable from static strings. Based on the cluster model and runtime imports:

1. Launch: The PE entry point (0x2800A) initializes the AutoIt3 interpreter runtime, decrypts the SCRIPT resource from .rsrc, and begins bytecode execution.
2. Script behavior (inferred from cluster siblings and import surface): The script likely performs initial system reconnaissance (registry queries, file enumeration, process list), establishes network connectivity via WinInet or raw WinSock, and downloads/stages a secondary payload. Collection capabilities include clipboard monitoring, screenshot capture (GDI32), and keylogging (USER32 GetAsyncKeyState).
3. Persistence: Registry writes via RegSetValueExW (Run key) or scheduled-task creation via ShellExecuteW / COM APIs are available to the script.
4. Lateral movement: WNetAddConnection2W and WNetUseConnectionW enable mapped-drive credential reuse.

No shellcode dropper, no CallWindowProc injection, and no hex-split obfuscation strings were observed in this sample — unlike siblings 6718622d, 64b37e90, and 70848598. This may be a simpler transport-only variant, or the staging logic may be entirely contained within the encrypted AutoIt bytecode.

Decompiled Behavior

Ghidra/radare2 decompilation of the C++ AutoIt runtime entry point reveals only interpreter bootstrap and script-decryption stubs. The actual malicious behavior lives in the encrypted SCRIPT resource and is not recoverable without AutoIt decompiler tools (MyAut2Exe / Exe2Aut). ^[capa.txt] capa correctly identified the AutoIt limitation and declined further analysis.

C2 Infrastructure

No plaintext C2 strings recovered. No hardcoded IPs, domains, URLs, mutex names, or named pipes were found in the string surface ^[strings.txt:1–2476]. All network indicators are likely runtime-resolved by the encrypted AutoIt script. Dynamic execution or AutoIt decompilation would be required to recover C2 addresses.

Interesting Tidbits

• Filename specificity: The PO number 2107-20454 and year 24 suggest a tailored social-engineering lure rather than a generic filename — possibly targeting a specific procurement department or using a believable PO format. ^[triage.json:5]
• Toolchain age: MSVC 12.0 (VS 2013) linker is older than the dominant MSVC 14.16 (VS 2017) seen in most Jul–Aug 2024 siblings. This may indicate the actor is using an older AutoItSC build environment or a preserved build VM. ^[exiftool.json:18]
• .rsrc entropy: 7.967/8.0 — near maximum entropy, confirming the script payload is encrypted, not compressed plaintext. ^[pefile.txt:152]
• No UPX: Unlike cluster siblings 68e48a8c, 6cc26f7c, and c310cb2e, this sample is a plain PE32. The actor did not apply a transport compression layer.
• Empty VS_VERSIONINFO: FileVersion and ProductVersion are both 0.0.0.0 ^[pefile.txt:239–242], consistent with the cluster pattern of minimal version metadata.
• CRC32 polynomial table: Binwalk identified a CRC32 table at offset 0xB64B0 within .rdata ^[binwalk.txt:5]; this is part of the standard AutoIt runtime / PCRE library and not a custom anti-analysis mechanism.

How To Mess With It (Homelab Replication)

To reproduce a comparable AutoItSC compiled dropper:

1. Install AutoIt v3.3.16.1 from https://www.autoitscript.com/site/autoit-downloads/
2. Write an AutoIt script (po_dropper.au3) that uses InetRead, FileWrite, RegWrite, and ShellExecute.
3. Compile with Aut2Exe (x86, GUI subsystem, no UPX).
4. Verify: Run strings on the output — expect AU3!EA06 header in .rsrc, PCRE error strings, and the full WinInet/WinSock import table. Run diec or file — expect PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections.
5. What you'll learn: How the AutoIt runtime abstracts Win32 API calls into a scripting surface, and why static analysis of the compiled bytecode is insufficient without decompilation.

Deployable Signatures

YARA Rule

rule autoitsc_purchase_order_cluster {
    meta:
        description = "AutoItSC v3 single-file compiled PE32 — purchase-order cluster variant"
        author = "Titus / PacketPursuit"
        date = "2026-07-06"
        reference = "raw/analyses/7317e559dedfa31367816b499d90ababa664c47810ff0d21e6143aae0e03a80a"
    strings:
        $au3_hdr = "AU3!EA06" ascii
        $au3_alt = "AU3!P/I" ascii
        $pcre1 = "numbers out of order in {} quantifier" ascii
        $pcre2 = "missing terminating ] for character class" ascii
        $pcre3 = "unrecognized character after (? or (?-" ascii
        $pcre4 = "PCRE does not support \\L, \\l, \\N{name}, \\U, or \\u" ascii
        $pcre5 = "lookbehind assertion is not fixed length" ascii
        $wininet1 = "InternetOpenW" ascii
        $wininet2 = "HttpSendRequestW" ascii
        $wsock1 = "WSAStartup" ascii
        $wsock2 = "gethostbyname" ascii
        $icmp = "IcmpSendEcho" ascii
        $userenv = "CreateEnvironmentBlock" ascii
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        filesize > 500KB and filesize < 2MB and
        ($au3_hdr or $au3_alt) and
        3 of ($pcre*) and
        2 of ($wininet*) and
        1 of ($wsock*) and
        $icmp and
        $userenv
}

Sigma Rule

title: AutoItSC Compiled Script Execution — Purchase Order Lure
status: experimental
description: Detects execution of AutoItSC-compiled PE32 with purchase-order themed filenames, a known cluster of malware droppers.
logsource:
  product: windows
  category: process_creation
detection:
  selection_filename:
    CommandLine|contains:
      - "PURCHASE_ORDER"
      - "PO_#"
      - "Purchase_Order"
      - "Invoice"
      - "QUOTATION"
      - "RFQ"
      - "BANK_DETAILS"
      - "DHL_AWB"
      - "SOA"
  selection_image:
    - Image|endswith: '.exe'
  selection_parent:
    - ParentImage|contains:
      - '\\Downloads\\'
      - '\\Temp\\'
      - '\\Desktop\\'
  condition: selection_filename and selection_image and selection_parent
falsepositives:
  - Legitimate procurement software using similar naming conventions
level: medium

IOC List

Behavioral Fingerprint Statement

This binary is a PE32 GUI executable compiled with the AutoIt v3 single-file compiler (AutoItSC). It carries a 200 KB–1 MB encrypted SCRIPT resource in .rsrc (RT_RCDATA) with an AU3!EA06 header. The runtime imports the full WinInet HTTP client, WinSock TCP/UDP surface, IPHLPAPI ICMP echo, ADVAPI32 registry and token APIs, and GDI32/USER32 screen capture primitives. The version resource is empty (0.0.0.0). No plaintext C2 strings are present in the PE surface. Execution initializes the AutoIt interpreter, decrypts the script resource, and runs the bytecode — actual malicious behavior (download, staging, persistence, collection) is script-defined and opaque to static analysis.

Detection Signatures

References

• Artifact ID: 40dfaf67-fae1-4a55-94a7-fecf46d333f1 ^[triage.json:4]
• Source: MalwareBazaar (ingested via OpenCTI connector) ^[metadata.json:10]
• Cluster entity: unclassified-autoit-compiled
• Concept: autoit-compiled-script-dropper
• Concept: social-engineering-purchase-order-masquerade

Provenance

Static analysis performed 2026-07-06 on pp-hermes. Tools: file (PE32 fingerprint), pefile (header/imports/sections), exiftool (metadata), strings (string extraction), rabin2 (radare2 binary info), binwalk (embedded artefact scan), yara (rule matching), capa (capability detection — AutoIt limitation triggered). No Ghidra decompilation performed; the encrypted AutoIt bytecode is not recoverable via standard RE tooling. CAPE sandbox unavailable (no Windows guest); dynamic analysis not performed.