54e64e: 7aed04ab — Signed IExpress SFX with AutoIt3 payload + batch variable-expansion reconstruction

Executive Summary

A 14 MB signed Microsoft Cabinet self-extractor (wextract.exe) repacked with a valid Authenticode certificate (Tim Kosse / Sectigo). The outer SFX silently extracts 22 files from an embedded CAB archive, then executes an obfuscated batch script that reconstructs two payloads via DOS variable-expansion concatenation: a legitimate AutoIt3.exe interpreter (Tragedy.exe) and a 13 MB compiled .a3x script (pEfTxgAk). The AutoIt3 interpreter is launched with the .a3x script as its argument. This is the fifth distinct build morph observed under the OpenCTI 54e64e umbrella label, demonstrating that 54e64e is a catch-all for Amadey-downloaded payloads rather than a coherent family.

What It Is

The .rsrc section is 13.9 MB with entropy 7.999, holding the CAB payload.^[pefile.txt:169-171] The PE has wextract.pdb in its debug directory.^[rabin2-info.txt:13]

How It Works

Stage 1 — Outer SFX Extraction

wextract.exe extracts the embedded CAB to a temporary directory. The CAB contains 22 files with meaningless names (Amazing.potm, Bee, Concentrate, Debut, etc.). All files share the same modification timestamp: 2026-05-22 03:44:42.^[7z listing]

Stage 2 — Batch Obfuscation & Payload Reconstruction

The file Debut is an obfuscated batch script (24,750 bytes) using DOS variable-expansion obfuscation. 383 SET variable assignments map nonsense words to single characters or short strings. The script:

1. Creates %TEMP%\445107 as a staging directory.^[decoded Debut line 1]
2. Writes "MZ" to Tragedy.exe via set /p.^[decoded Debut line 4]
3. Concatenates 9 CAB fragments (Bee, Rh.potm, Papua.potm, Likelihood.potm, Er.potm, Payroll.potm, Returns, External.potm, Employer) into Tragedy.exe.^[decoded Debut line 5]
4. Concatenates 10 CAB fragments (Consolidated, Pour, Die, Plains.potm, Developmental.potm, Mercy, Amazing.potm, Hp, Fr.potm, Concentrate) into pEfTxgAk.^[decoded Debut line 8]
5. Executes: start %TEMP%\445107\Tragedy.exe %TEMP%\445107\pEfTxgAk.^[decoded Debut line 9]

This is not PowerShell variable expansion (as seen in batch-powershell-variable-expansion-obfuscation); it is a file-concatenation obfuscation technique where binary payloads are split across CAB files and reassembled via copy /b /y commands hidden behind percent-encoded variable names.

Stage 3 — AutoIt3 Execution

Tragedy.exe reconstructs as AutoIt v3.3.18.0 (AutoIt3.exe), a legitimate Windows automation interpreter.^[exiftool on reconstructed Tragedy.exe] It is signed and unmodified. The second reconstructed file, pEfTxgAk, is a compiled AutoIt3 script (.a3x format) with AU3!EA06 magic at offset 0x10.^[xxd pEfTxgAk]

The AutoIt3 interpreter loads and executes the .a3x script. The script itself is opaque to static string extraction (compiled AutoIt bytecode). Strings analysis of the .a3x blob yields no hardcoded C2 URLs, IPs, or file paths — all such behavior is runtime-encoded within the compiled script.

Decompiled Behavior

Static RE on the outer wextract.exe reveals only legitimate Microsoft SFX functionality. The entry point at 0x140008200 calls standard extraction routines (CreateDirectoryA, FindResourceA, LoadResource, CreateProcessA).^[rabin2-info.txt:11, r2 imports] No anti-debug, no VM checks, no encryption beyond the CAB LZX compression.

The Tragedy.exe (AutoIt3) has a standard Win32 API import table including WININET.dll (InternetOpenUrlW, HttpSendRequestW, FtpOpenFileW), WSOCK32.dll, and advapi32.dll (RegDeleteKeyExW).^[r2 imports Tragedy.exe] These are the legitimate AutoIt3 runtime dependencies; the malicious behavior lives in the .a3x script, not the interpreter.

C2 Infrastructure

No hardcoded C2 recovered. The outer SFX and the AutoIt3 interpreter contain no network indicators. The .a3x script is compiled bytecode with no plaintext strings. Dynamic analysis (CAPE) is required to observe the runtime C2 behavior of the compiled script.

Interesting Tidbits

• Valid signature abuse: The outer PE is signed with a legitimate Sectigo-issued code-signing certificate belonging to Tim Kosse (FileZilla founder). The attacker did not need to steal a cert or self-sign — they simply repacked a signed wextract.exe and replaced its CAB resource, leaving the signature intact. The Authenticode hash covers the PE headers and code sections but not the .rsrc directory, so CAB replacement does not invalidate the signature.^[signature.der]
• Fragmentation opsec: Splitting the AutoIt3 interpreter and .a3x script across 19 separate CAB fragments forces analysts to reconstruct the batch logic before understanding the payload. Each fragment is individually meaningless to file and strings.
• Name masquerade: The CAB files use .potm extensions (PowerPoint Open XML macro template) but contain raw binary data. This may confuse sandbox file-type heuristics.
• Timestamp fabrication: The PE claims 2062 compilation but the CAB files inside show 2026-05-22. The Sectigo certificate was issued 2024-12-17 (from the DER chain). The repacking likely occurred in late May 2026.
• Amadey delivery chain: The dropped-by-amadey co-label strongly suggests this sample was delivered by the Amadey downloader botnet to compromised hosts. The IExpress SFX + AutoIt3 pattern has been observed in other Amadey campaigns (e.g., asgardprotector), though this sample uses a signed outer binary and a more elaborate batch-reconstruction stage.

How To Mess With It (Homelab Replication)

Toolchain

1. Obtain a signed wextract.exe from a legitimate Windows ISO or IExpress package.
2. Use Resource Hacker or rsrcedit to replace the .rsrc/CABINET resource with your own CAB.
3. Build the CAB with makecab or 7z containing your payload fragments.
4. Write a batch obfuscator that splits payload bytes across SET variables and reassembles with copy /b /y.

Verification

• Run capa on the rebuilt SFX — it will hit the "installer file limitation" rule exactly as this sample does.^[capa.txt]
• Run osslsigncode verify — signature remains valid because .rsrc is not hashed.

What you'll learn: How Authenticode signature coverage works (and doesn't work) for resource sections, and why sandboxes that trust signed binaries may execute this without scrutiny.

Deployable Signatures

YARA Rule

rule iexpress_sfx_autoit3_payload {
    meta:
        description = "Signed IExpress SFX with embedded AutoIt3 interpreter and .a3x script fragments"
        author = "PacketPursuit"
        date = "2026-06-13"
        sha256 = "7aed04abf7cc42695481b89e4db2e8760eb56dd0fafc7da9f13a43c1158efc5e"
    strings:
        $wextract_pdb = "wextract.pdb" ascii wide
        $cab_magic = { 4D 53 43 46 }  // MSCF CAB header
        $au3_magic = "AU3!EA" ascii
        $mz = { 4D 5A }
        $batch_set = /^Set [A-Za-z]{3,8}=/i
        $batch_concat = /copy \/b \/y/i
    condition:
        uint16(0) == 0x5A4D and
        $wextract_pdb and
        $cab_magic and
        $au3_magic and
        filesize > 10MB and
        // At least 10 MZ signatures (interpreter + script fragments each have MZ)
        #mz > 10
}

Sigma Rule

title: IExpress SFX AutoIt3 Payload Execution
status: experimental
description: Detects wextract.exe spawning AutoIt3.exe with a command-line argument, indicating a repacked SFX dropper
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\wextract.exe'
    selection_child:
        Image|endswith: '\AutoIt3.exe'
    selection_cmdline:
        CommandLine|contains:
            - '.a3x'
            - 'Tragedy'
            - 'pEfTxgAk'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate IExpress installers that bundle AutoIt3 (rare)
level: high

IOC List

Behavioral Fingerprint

This binary presents as a signed Microsoft Cabinet self-extractor (wextract.exe) with a valid Sectigo Authenticode chain. Upon execution, it extracts 22 files to a temp directory, then runs an obfuscated batch script that concatenates 9 fragments into Tragedy.exe (AutoIt3 interpreter) and 10 fragments into pEfTxgAk (compiled .a3x script). The final execution chain is AutoIt3.exe <script.a3x>. No C2 strings are visible in any stage except potentially inside the compiled .a3x bytecode. The outer PE has no anti-debug or VM checks.

Detection Signatures

References

• Artifact ID: c2f69234-2965-4fab-9e93-7eb45470f4fb
• OpenCTI labels: 54e64e, dropped-by-amadey, exe, malware-bazaar ^[metadata.json]
• Amadey downloader family (external): https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
• Related corpus sample: asgardprotector (d59dc2f2) — unsigned IExpress SFX with AutoIt3 payload, same delivery pattern
• Related entity: 54e64e — umbrella label for Amadey-downloaded payload cluster

Provenance

• Analysis based on file.txt, exiftool.json, pefile.txt, strings.txt, rabin2-info.txt, binwalk.txt, triage.json, metadata.json, capa.txt (installer limitation warning), and manual CAB extraction via 7z and dd.
• Certificate chain extracted with openssl pkcs7 -inform DER -print_certs from the PE security directory at offset 0xD5A808.
• Batch script decoded by substituting 383 SET variable definitions into percent-encoded command lines.
• Payloads reconstructed via copy /b /y equivalent (cat concatenation) and verified with file and exiftool.
• AutoIt3 interpreter confirmed by version info strings and AU3!EA06 magic in the .a3x blob.
• Static-only analysis; CAPE skipped (no Windows guest). Runtime C2 behavior of the .a3x script is undetermined.