unclassified-autoit-compiled: 7768873f — Invoice lure, 593 KB encrypted script in overlay, Jan 2012 PE timestamp

Executive Summary

AutoIt-compiled single-file PE32 (INVOICE.exe) distributing a 593 KB encrypted compiled script in the file overlay (not .rsrc). The script is encrypted with the AU3!EA06 format and cannot be decompiled without the original source or MyAut2Exe tooling — autoit-ripper fails because the script is in the overlay rather than a PE resource directory. The binary carries the standard AutoItSC v3.3.8.1 import surface (WinInet, WinSock, GDI32, ADVAPI32) and a fabricated Jan 2012 PE timestamp with MSVC 10.0 linker. This is the thirty-sixth confirmed sibling of the unclassified-autoit-compiled cluster and the seventh confirmed with overlay (not .rsrc) script placement.

What It Is

• File: INVOICE.exe — 1,298,921 bytes, PE32 GUI x86, 4 sections ^[file.txt]
• Compiler: AutoItSC v3.3.8.1 (single-file compiler), MSVC 10.0 linker (VS 2010) ^[pefile.txt:33-34]
• Timestamp: Sun Jan 29 21:32:28 2012 UTC — fabricated/stolen, consistent with siblings ff84806a, e5647a2d, f346b7e9, d990bd1b6, 941a189b, a8beee89 ^[rabin2-info.txt:11]
• Version info: Empty VS_VERSIONINFO (FileVersion 3.3.8.1 reflects AutoIt runtime, not payload) ^[exiftool.json:27-38]
• Script: 607,721 bytes encrypted AutoIt bytecode in file overlay, header AU3!EA06 ^[hexdump:overlay]
• Script placement: Overlay (not RT_RCDATA resource) — 7th sibling with this placement ^[pefile.txt:143-156]
• Signing: Unsigned ^[rabin2-info.txt:27]
• PDB: None
• YARA: PE_File_Generic, Suspicious_Wininet_Imports ^[yara.txt]
• Packing: None (plain PE32, non-UPX) ^[binwalk.txt]
• capa: AutoIt file limitation warning; aborts capability extraction ^[capa.txt:5-15]
• floss: Errored (argument parsing failure); no decoded strings ^[floss.txt]

How It Works

1. AutoIt runtime loads, initializes the interpreter heap, and searches for the compiled script payload.

2. Script location: Unlike most siblings that store the script in .rsrc (RT_RCDATA type 0xA, name SCRIPT), this sample places the script in the file overlay after the last section. The overlay begins at offset 0xA8C00 (after .rsrc section raw end at 0x95400 + 0x13800) and is 607,721 bytes. ^[hexdump:overlay]

3. Script decryption: The runtime reads the overlay, validates the AU3!EA06 magic at offset 0x0E (H}AU3!EA06T), and decrypts/decompresses the compiled bytecode in-process. The decryption algorithm is internal to AutoIt and not publicly documented. ^[strings.txt:1038]

4. Script execution: The interpreter begins executing the AutoIt script. All malicious behavior — payload staging, C2 URLs, persistence, keylogging, data exfil — lives inside the encrypted script and is opaque to static analysis.

5. Runtime API surface: The AutoItSC interpreter imports the following DLLs, providing the script with full Windows API access:

   • Network: WININET.dll (HTTP/FTP/URL cracking), WSOCK32.dll (raw TCP/UDP, socket creation, DNS resolution) ^[pefile.txt:355-369]^[pefile.txt:267-288]
   • GUI / Collection: GDI32.dll (screenshot primitives), USER32.dll (clipboard access, window enumeration, GetAsyncKeyState for keylogging) ^[pefile.txt:897-896]
   • Privilege / Persistence: ADVAPI32.dll (token manipulation, registry read/write, CreateProcessAsUserW, InitiateSystemShutdownExW) ^[pefile.txt:900-934]
   • Process / Injection: KERNEL32.dll (VirtualAllocEx, WriteProcessMemory, OpenProcess, CreateProcessW, CreateThread) ^[pefile.txt:404-498]
   • System Recon: ICMP.DLL (IcmpSendEcho), PSAPI.DLL (GetProcessMemoryInfo), USERENV.dll (LoadUserProfileW), VERSION.dll (VerQueryValueW) ^[pefile.txt:378-394]^[pefile.txt:516-520]
   • Media / Audio: WINMM.dll (mciSendStringW, waveOutSetVolume) ^[pefile.txt:310-313]
   • Common Controls: COMCTL32.dll (image list, drag-and-drop primitives) ^[pefile.txt:322-333]

This is the identical runtime surface observed across all thirty-five prior siblings in the cluster.^[entities/unclassified-autoit-compiled.md]

Decompiled Behavior

Ghidra / radare2 decompilation of the AutoItSC interpreter runtime was not pursued. The runtime is the well-known AutoItSC v3.3.8.1 C++ interpreter; decompiling it adds no family-specific insight beyond what the import table and resource layout already reveal. Cluster behavior is documented at unclassified-autoit-compiled.

The script itself is not recoverable:

• autoit-ripper (--ea EA06) fails with "Couldn't find any appropiate PE resource directory" because the script is in the overlay, not .rsrc.
• MyAut2Exe (not installed on this host) would be required to recover the .au3 source.
• No plaintext script fragments are visible in the overlay beyond the AU3!EA06 header and the autoitscript.com support string in .rdata.

C2 Infrastructure

C2 obfuscated / runtime-resolved. No hardcoded IP addresses, domains, URLs, mutex names, or registry keys are visible in the PE strings, imports, or overlay. All network indicators are expected to be embedded inside the encrypted script and decoded at runtime by the AutoIt interpreter.^[strings.txt — no C2 URLs recovered]

Interesting Tidbits

• Invoice lure theme: The filename INVOICE.exe is the most generic lure observed in this cluster — no company name, no numeric suffix, no double extension. This suggests bulk distribution or a template before customization.^[metadata.json]
• Old linker: MSVC 10.0 (VS 2010) is the oldest linker observed in the cluster since sibling 941a189b (also VS 2010). Most siblings use MSVC 12.0 (VS 2013) or 14.16 (VS 2017). This may indicate a different build environment or an older AutoItSC release.
• Four-section PE: Most siblings have 5 sections (.text, .rdata, .data, .rsrc, .reloc). This sample has only 4 — no .reloc section. The linker stripped relocations (IMAGE_FILE_RELOCS_STRIPPED flag set).^[pefile.txt:38]
• Overlay script placement: At 607,721 bytes, this is the largest overlay script in the cluster (previous largest: e5647a2d at 710 KB, which was .rsrc placement). The overlay placement breaks autoit-ripper and other PE-resource-based tools, providing a mild anti-analysis benefit.
• PCRE regex bloat: The full PCRE error-message table (80+ Unicode script names, 70+ regex error strings) is present in .rdata, confirming the runtime links PCRE statically. This trait is shared with all siblings.^[strings.txt:370-500]
• No packing or anti-debug: The PE is plain (non-UPX), with standard section names and no debugger checks beyond IsDebuggerPresent in the IAT. Evasion comes entirely from script-level logic inside the encrypted bytecode.^[pefile.txt:556-583]
• AU3 marker: The overlay header at offset 0x0E reads H}AU3!EA06T — the AU3!EA06 magic confirms AutoIt v3.3.8.1+ compiled bytecode format.^[strings.txt:1038]

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 on Windows 7+.

1. Install AutoIt from https://www.autoitscript.com/site/autoit/downloads/.
2. Write a simple script (test.au3) that calls InetRead(), RegWrite(), and PixelChecksum().
3. Compile with Aut2Exe.exe (right-click → Compile Script, or CLI: Aut2Exe.exe /in test.au3 /out test.exe).
4. The output will be a PE32 with 4-5 sections, a SCRIPT resource in .rsrc or overlay, and AU3!EA06 header bytes.

Verification:

• Run capa test.exe — it should emit the same AutoIt limitation warning.
• Run pefile.py or rabin2 -I — confirm AU3!EA06 strings and WinInet/WSOCK32/GDI32 imports.
• Compare import table to this sample: you should see WININET, WSOCK32, GDI32, USER32, ADVAPI32, SHELL32.

What you'll learn: How a BASIC-like scripting language can produce a statically opaque PE that defeats capa, confuses triage pipelines, and requires decompiler tooling (MyAut2Exe) to recover the actual payload.

Deployable Signatures

YARA rule

rule AutoItSC_SingleFile_PE32_Invoice_Lure
{
    meta:
        description = "AutoIt v3 single-file compiled PE32 with encrypted script in overlay (invoice lure)"
        author = "PacketPursuit SOC"
        date = "2026-07-06"
        sha256 = "7768873f4b7e6b6c594bdb182bcdde73d9f8ab3b13b19fe87b5fb32bc159dd01"
        family = "unclassified-autoit-compiled"
    strings:
        $au3_hdr = "AU3!EA06"
        $autoit_err1 = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support."
        $autoit_err2 = "AutoIt Error"
        $pcre_err1 = "numbers out of order in {} quantifier"
        $pcre_err2 = "unrecognized character follows \\"
        $wininet = "WININET.dll" ascii wide
        $wsock32 = "WSOCK32.dll" ascii wide
        $gdi32 = "GDI32.dll" ascii wide
        $advapi32 = "ADVAPI32.dll" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $au3_hdr and
        3 of ($autoit_err*, $pcre_err*) and
        3 of ($wininet, $wsock32, $gdi32, $advapi32) and
        filesize > 1MB
}

Sigma rule

title: AutoIt Compiled Script Execution with Network Activity
id: 7768873f-4b7e-6b6c-594b-db182bcdde73
status: experimental
description: Detects execution of AutoIt-compiled PE followed by outbound network connections within 60 seconds.
logsource:
  category: process_creation
  product: windows
detection:
  selection_pe:
    - Image|endswith: '.exe'
    - Hashes|contains:
      - '7768873f4b7e6b6c594bdb182bcdde73d9f8ab3b13b19fe87b5fb32bc159dd01'
  selection_network:
    - Initiated: true
    - DestinationPort|contains:
      - 80
      - 443
      - 8080
      - 4444
  selection_autoit_strings:
    CommandLine|contains:
      - 'INVOICE.exe'
      - 'DHL_AWB_TRACKING_DETAILS.exe'
      - 'RFQ_PROCUREMENT2024.exe'
      - 'PURCHASE_ORDER_PO'
      - 'HAWB No Original'
      - 'Customer_Remittance'
      - 'Payment_Reference_SOA'
  condition: selection_pe and selection_network and selection_autoit_strings
timeframe: 60s
falsepositives:
  - Legitimate AutoIt automation scripts (rare in enterprise)
level: high

IOC list

Behavioral fingerprint statement

This binary is a single-file AutoIt v3 compiled PE32. At launch, the AutoIt interpreter initializes and decrypts a ~600 KB compiled script stored in the file overlay (not .rsrc). The script is opaque to static analysis. The runtime imports WinInet, WinSock, GDI32, USER32, ADVAPI32, and KERNEL32, providing the script with full network, GUI, registry, and process-injection capabilities. No hardcoded C2 is visible. The PE carries a fabricated Jan 2012 timestamp and is unsigned. Network activity, if any, would be initiated by the script at runtime and is not predictable from static artefacts.

Detection Signatures

capa → ATT&CK mapping

References

• Artifact ID: a448497c-cd43-48ce-8538-50ee2842235f
• Source: OpenCTI / MalwareBazaar
• Family entity: unclassified-autoit-compiled
• Concept: autoit-compiled-script-dropper
• Related: formbook — AutoIt-delivered infostealer with different drop pattern

Provenance

• file.txt — file v5.44
• pefile.txt — pefile Python library
• strings.txt — strings GNU binutils
• capa.txt — capa v7 (Mandiant)
• floss.txt — flare-floss v3.1.1 (FireEye) — errored
• exiftool.json — exiftool v12.76
• rabin2-info.txt — radare2 v5.9.2
• binwalk.txt — binwalk v2.3.4
• yara.txt — yara v4.5.2
• Overlay dump — Python pefile manual extraction
• autoit-ripper v1.0 — failed (script in overlay, not PE resource)