unclassified-autoit-compiled: 798fa958 — UPX-packed transport of 561c3ff6, 60.06% compression

Executive Summary

UPX 4.2.2-packed transport layer over the already-analyzed AutoItSC single-file PE32 561c3ff6 (DHLXINVX0914534XPDF.exe). Unpacks to an identical SHA-256 (1,267,712 bytes). No new threat logic — the compressed wrapper reduces file size from 1.21 MB to 743 KB to evade size-based sandboxes or email filters. Fifty-eighth confirmed sibling in the unclassified-autoit-compiled cluster.

What It Is

How It Works

This sample is the fifty-eighth confirmed sibling of the unclassified-autoit-compiled cluster and a packed duplicate of sibling 561c3ff6. The UPX wrapper compresses the outer AutoItSC interpreter/runtime and the encrypted .rsrc script section, reducing the on-disk footprint by 40%. At execution, the UPX stub decompresses the original payload in-memory and transfers control to the standard AutoItSC entry point. All threat logic — encrypted AutoIt script, payload staging, C2, persistence — resides inside the unpacked binary and is identical to 561c3ff6.

For the full behavioural and static analysis of the unpacked payload, see the sibling report: /intel/analyses/561c3ff6b268566497a4e74bd61eed2058682100d2dfc9bb0e1edf78e743d3f0.html.

Per-sample delta (this wrapper only):

• Packer: UPX 4.2.2 with UPX0/UPX1 section names, UPX0 raw size zero (uninitialized data placeholder), UPX1 entropy 7.937. ^[terminal: python pefile]
• Section layout: 3 sections (UPX0, UPX1, .rsrc) vs 5 sections in the unpacked binary (.text, .rdata, .data, .rsrc, .reloc). The .rsrc section in the packed form is the compressed script resource (entropy 7.930), which the UPX stub maps into memory before decompression. ^[pefile.txt]
• Import table: Stripped to the minimal UPX loader imports (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess) plus a single bait import from each of 17 DLLs (ADVAPI32.dll.GetAce, COMCTL32.dll.ImageList_Remove, etc.) to satisfy the Windows loader. The full AutoItSC import surface is restored by the UPX stub at runtime. ^[pefile.txt]

Decompiled Behavior

Ghidra/radare2 analysis of the packed binary is limited to the UPX decompression stub (x86 position-independent code) and the compressed data blob. Decompiling the stub yields a standard UPX NRV2E/UCL decompressor loop followed by import table reconstruction and a jump to the original entry point. No anti-debug or VM checks are present in the stub.

The decompressed payload is identical to 561c3ff6; see that report for AutoItSC runtime details. Capa flags the packed sample with the (internal) packer file limitation warning and aborts meaningful analysis. ^[capa.txt]

C2 Infrastructure

No C2 indicators in the packed wrapper. All network infrastructure is encrypted inside the AutoIt script and documented in the 561c3ff6 sibling report. ^[/intel/analyses/561c3ff6b268566497a4e74bd61eed2058682100d2dfc9bb0e1edf78e743d3f0.html]

Interesting Tidbits

• UPX 4.2.2 is the same version observed on siblings 498f7bf3, 68e48a8c, c310cb2e, 6cc26f7c, and fb495efe in this cluster. ^[terminal: upx -l] ^[entities/unclassified-autoit-compiled.md]
• The AU3!EA06 script header is not visible in the packed file's strings output; it only appears after UPX decompression, confirming the script is inside the compressed region. ^[strings.txt] ^[terminal: xxd unpacked]
• The packed .rsrc section is 380,928 bytes (compressed), versus 352,163 bytes in the unpacked .rsrc — the difference is UPX metadata overhead and alignment padding. ^[pefile.txt]
• This is the sixth UPX-packed sibling in the cluster, joining 498f7bf3, 68e48a8c, c310cb2e, 6cc26f7c, and fb495efe. ^[entities/unclassified-autoit-compiled.md]

How To Mess With It (Homelab Replication)

1. Take any AutoItSC single-file PE32 (e.g., a benign compiled script)
2. Pack with upx --best --lzma your.exe (UPX 4.2.2 produces ~60% ratio on AutoItSC binaries)
3. Verify: upx -l your.exe should show win32/pe format, ratio ~60%
4. Unpack: upx -d your.exe — SHA-256 must match the original
5. Capa should hit (internal) packer file limitation on the packed form, and (internal) autoit file limitation on the unpacked form

Deployable Signatures

YARA Rule

rule upx_autoitsc_dhl_lure : malware {
    meta:
        description = "UPX-packed AutoItSC v3.3.8.1 single-file PE32 with DHL/invoice social-engineering lure"
        author = "PacketPursuit"
        date = "2026-07-23"
        hash = "798fa95813d288933757022c943a26641e0fa710a5e94b294d161dc9787cbf16"
    strings:
        $upx0 = "UPX0" ascii
        $upx1 = "UPX1" ascii
        $autoit_header = "AU3!EA06" ascii
        $autoit_text = ".text$lp00AutoItSC" ascii
        $pcre_err1 = "numbers out of order in {} quantifier" ascii
        $pcre_err2 = "PCRE does not support \\L, \\l, \\N{name}, \\U, or \\u" ascii
        $dhl_lure1 = "DHLXINVX" ascii wide nocase
        $dhl_lure2 = "DHL_AWB_TRACKING_DETAILS" ascii wide nocase
        $dhl_lure3 = "COMMECIAL_INVOICE_AND_DHL_AWB" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and
        $upx0 and
        $upx1 and
        $autoit_header and
        $autoit_text and
        (2 of ($pcre_err*)) and
        (1 of ($dhl_lure*))
}

Sigma Rule

title: UPX-Packed AutoItSC PE32 Execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith:
            - '\\DHLXINVX*.exe'
            - '\\DHL_AWB_TRACKING_DETAILS.exe'
            - '\\COMMECIAL_INVOICE_AND_DHL_AWB_TRACKING_DETAILS.exe'
    condition: selection
falsepositives:
    - None known for these exact filenames
level: high

IOC List

Behavioral Fingerprint

This binary is a UPX 4.2.2-compressed AutoItSC v3.3.8.1 single-file PE32. The UPX stub (UPX0/UPX1 sections) decompresses the original AutoItSC runtime and encrypted script resource into memory, reconstructs the import table (17 DLLs including WinInet, WinSock, ADVAPI32, GDI32), and jumps to the original entry point. The interpreter then decrypts the AU3!EA06-header script from .rsrc and executes the compiled AutoIt bytecode. No anti-debug or VM checks are present in the UPX stub. The unpacked payload is identical to 561c3ff6.

Detection Signatures

References

• MalwareBazaar artifact: 3cae24f1-0f13-41d9-9736-cb1d8e6bd831
• Unpacked sibling report: /intel/analyses/561c3ff6b268566497a4e74bd61eed2058682100d2dfc9bb0e1edf78e743d3f0.html
• Cluster entity page: unclassified-autoit-compiled

Provenance

Analysis based on:

• file.txt — file command output (PE32 executable, UPX compressed, 3 sections)
• exiftool.json — ExifTool PE metadata (linker 14.16, timestamp 2024-12-18)
• pefile.txt — pefile parser output (UPX sections, minimal imports, stripped IAT)
• strings.txt — strings -n 4 output (no AU3!EA06 visible in packed form; UPX marker strings)
• capa.txt — Mandiant capa v8.1.0 (packer limitation warning)
• rabin2-info.txt — radare2 binary header (unsigned, canary true, PIC)
• binwalk.txt — binwalk scan (plain PE header only)
• yara.txt — YARA matches (PE_File_Generic, Likely_Packer_UPX)
• triage.json — triage metadata (filename, artifact ID, OpenCTI labels)
• Terminal commands: upx -l, upx -d, SHA-256 comparison, pefile section enumeration

Sample was not detonated in CAPE (no Windows guest available). All behavior inferences are static-only and rely on the known AutoItSC malware patterns documented in the cluster entity page.