unclassified-autoit-compiled: 7bfa4723 — Purchase-order lure, 768 KB encrypted script in overlay

Executive Summary

AutoItSC v3.3.8.1 single-file PE32 (New_order_098765678.exe) with a 768 KB encrypted compiled script stored in the file overlay (not .rsrc). Eighth confirmed sibling with overlay placement. Purchase-order social-engineering lure, fabricated Jan 2012 PE timestamp, empty VS_VERSIONINFO, and the full AutoIt runtime import surface (WinInet/WinSock/ADVAPI32/GDI/PSAPI/ICMP). No plaintext C2 recovered; threat logic is opaque without AutoIt decompilation. Static-only analysis.

What It Is

VS_VERSIONINFO is present but the FileDescription field is empty ^[exiftool.json:36]. The CompiledScript field explicitly identifies the runtime as "AutoIt v3 Script: 3, 3, 8, 1" ^[exiftool.json:38].

How It Works

Script Placement — Overlay (not .rsrc)

Unlike the majority of this cluster (~30 siblings) that store the encrypted script inside .rsrc as an RT_RCDATA resource, this sample places it in the file overlay after the last PE section. ^[pefile.txt:138-156]

• Overlay offset: 649,216 bytes (0x9E800) ^[rabin2-info.txt:23]
• Overlay size: 768,889 bytes
• Overlay entropy: ~7.9997 (effectively random — AES/Custom encrypted) ^[terminal:entropy-calc]
• Header: a3 48 4b be 98 6c 4a a9 99 4c 53 0a 86 d6 48 7d — the AU3!EA06 magic is present at offset 0x12 in the overlay ^[terminal:overlay-inspection]

This placement breaks naive autoit-ripper tools that scan only .rsrc for SCRIPT resources. It is the eighth confirmed sibling with this placement, after ff84806a, f346b7e9, e5647a2d, d990bd1b6, a8beee89, 941a189b, and 7768873f.

Build Fingerprint

The binary matches the cluster's standard build fingerprint:

• 4 sections (.text, .rdata, .data, .rsrc) — no .reloc ^[pefile.txt:76-156]
• .text entropy: 6.68 (expected for compiled C runtime + interpreter) ^[pefile.txt:92]
• .rdata entropy: 4.80 (IAT + string tables) ^[pefile.txt:112]
• .data entropy: 2.15 (low — initialized global data) ^[pefile.txt:132]
• .rsrc entropy: 5.54 (icons, dialogs, strings, manifest) ^[pefile.txt:152]
• No RT_RCDATA resource of suspicious size; the largest .rsrc entries are the icon suite (max 9,640 bytes) and RT_MANIFEST (620 bytes) ^[terminal:resource-dump]

Import Surface

The full AutoIt runtime import table is present, identical to cluster siblings:

Network / C2: WSOCK32.dll (socket, connect, send, recv, WSAStartup, gethostbyname, inet_addr, etc.) ^[pefile.txt:267-288]; WININET.dll (InternetOpenW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, InternetOpenUrlW, FtpOpenFileW, InternetReadFile, etc.) ^[pefile.txt:355-368]

Process / Injection: OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateProcessW, CreateThread, CreateToolhelp32Snapshot, Process32FirstW/NextW ^[pefile.txt:420-433]

Registry / Persistence: RegSetValueExW, RegCreateKeyExW, RegOpenKeyExW, RegQueryValueExW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyExW ^[pefile.txt:796-828]

Privilege / Token: OpenProcessToken, OpenThreadToken, LookupPrivilegeValueW, AdjustTokenPrivileges, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW ^[pefile.txt:806-826]

Clipboard / Screen: OpenClipboard, GetClipboardData, SetClipboardData, EmptyClipboard, GetAsyncKeyState, SendInput, keybd_event, mouse_event, GetDC, StretchBlt, GetDIBits ^[pefile.txt:698-705, 641, 753]

Reconnaissance: PSAPI.DLL (EnumProcesses, EnumProcessModules, GetProcessMemoryInfo) ^[pefile.txt:378-381]; ICMP.DLL (IcmpCreateFile, IcmpSendEcho) ^[strings.txt:518-520]

PCRE Runtime: Full embedded PCRE regex library strings are present in .rdata, including the complete Unicode script-name table (Arabic, Armenian, Avestan, Balinese, Bengali ... Ugaritic) and error-message table (numbers out of order in {} quantifier, unmatched parentheses, etc.) ^[strings.txt:369-403, 512-515]. This is a cluster-defining trait and suggests script-side data harvesting or pattern matching.

Anti-Analysis

• Compiled script encryption: The overlay payload is encrypted with ~8.0 entropy; no plaintext strings recoverable. ^[terminal:entropy-calc]
• Fabricated timestamp: Jan 2012 PE timestamp is a known cluster hallmark used to age the binary. ^[pefile.txt:34]
• Empty VS_VERSIONINFO: No product name, company, or description to cluster on. ^[exiftool.json:36]
• No .reloc section: Prevents easy rebasing and hints at a fixed-base assumption in the shellcode or interpreter stub. ^[pefile.txt:76]

Decompiled Behavior

Static RE via radare2 (level-3 analysis, 2,514 functions identified) confirms the entry point at 0x004165c1 is a standard MSVC C runtime initialization sequence (__security_init_cookie → GetStartupInfoW → PE header validation → main) ^[r2:entry0]. No unusual anti-debug or VM checks are present in the compiled runtime — the threat logic lives entirely inside the encrypted AutoIt script overlay.

Ghidra decompilation was not attempted because the binary is a known AutoItSC runtime; capa explicitly warns that "capa cannot handle AutoIt scripts" and directs analysts to manual tools like MyAut2Exe. ^[capa.txt] The runtime itself is benign; all malicious behavior is script-defined and opaque without decryption/decompilation.

C2 Infrastructure

No plaintext C2 indicators recovered. The encrypted overlay contains the script logic, and no URLs, IPs, domains, mutex names, or pipe names were found in the PE's string surface or imports. ^[strings.txt, terminal:string-grep]

Cluster siblings have historically delivered inner payloads that beacon via:

• SMTP exfil (AgentTesla inner payload in 6718622d) ^[/intel/analyses/6718622d94d373a123cac9f8cc6789bc1132eed19a5a9232dd0454ee869d910c.html]
• HTTP/HTTPS downloaders (WinInet surface present)
• Raw TCP sockets (WSOCK32 surface present)

This sample's C2 modality is inferred but unconfirmed pending decompilation.

Interesting Tidbits

• Filename semantic: New_order_098765678.exe follows the cluster's purchase-order/procurement naming convention (PO_#86637.exe, Final_order.exe, PO-A1702108.exe, PO20240627-001.exe, PO-22012025-RFQ.exe). The numeric suffix is a low-entropy filler typical of template-generated lure names. ^[triage.json]
• Overlay placement trend: Overlay-stored scripts are a minority (~8 of 37) but persistent across the cluster timeline (Jan 2012 → Jul 2024). This suggests a deliberate builder option or forked compiler configuration. ^[entity:unclassified-autoit-compiled]
• Missing .reloc: All cluster siblings lack .reloc, which is unusual for a GUI PE and may reflect a custom linker flag or stripped output from the AutoItSC build pipeline. ^[pefile.txt:76]
• PCRE bloat: The PCRE error-message and Unicode-script tables add ~20 KB of identifiable .rdata strings. These are harmless artifacts but serve as a cluster fingerprint. ^[strings.txt:369-403]
• Floss failure: flare-floss was invoked with incorrect argument ordering (--no flag received the file path as its value), producing no decoded strings. ^[floss.txt] Correct invocation would require --no static stack tight decoded syntax.

How To Mess With It (Homelab Replication)

Reproducing the exact build requires the AutoIt v3.3.8.1 single-file compiler (AutoItSC). The builder is not publicly available as a standalone download, but the open-source AutoIt v3 interpreter can be compiled with the SC (single-file) option.

1. Install AutoIt v3.3.8.1 (or latest) from autoitscript.com
2. Write a .au3 script with network, registry, and file operations
3. Compile with Aut2Exe.exe /in script.au3 /out payload.exe /icon lure.ico
4. Observe: output is a PE32 with .text entropy ~6.5–7.0, PCRE strings in .rdata, empty VS_VERSIONINFO, and encrypted AU3!EA06 script in .rsrc or overlay depending on compiler flags
5. Verification: Run capa payload.exe — it will flag the "autoit file limitation" warning and report minimal capabilities, confirming the script logic is opaque to static analysis

What you learn: How a BASIC-like scripting runtime can be weaponized to hide malicious behavior behind a compiled C runtime that defeats standard static-analysis pipelines.

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PE32_Cluster
{
    meta:
        description = "AutoItSC v3 single-file compiled PE32 — cluster fingerprint"
        author = "Titus / PacketPursuit"
        date = "2026-07-07"
        sha256 = "7bfa4723b2386a09e99d874b7d1da33999c163e6dfab9692ac3c496fc9699e91"
    strings:
        $au3_magic = { A3 48 4B BE 98 6C 4A A9 99 4C 53 0A 86 D6 48 7D }
        $autoit_str = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support." ascii wide
        $pcre_err1 = "numbers out of order in {} quantifier" ascii
        $pcre_err2 = "unmatched parentheses" ascii
        $pcre_err3 = "this version of PCRE is not compiled with PCRE_UTF8 support" ascii
        $compiled = "CompiledScript" ascii wide
        $ver1 = "AutoIt v3 Script" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (
            ($autoit_str and $ver1) or
            ($au3_magic at pe.overlay.offset) or
            (3 of ($pcre_err*))
        ) and
        filesize > 500KB
}

Behavioral Hunt Query (Sigma)

title: AutoItSC Single-File PE32 Execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - ImageLoaded|endswith:
            - '\\New_order_098765678.exe'
        - CommandLine|contains:
            - 'New_order'
            - '098765678'
    condition: selection
falsepositives:
    - None expected for this exact filename
level: high

IOC List

Behavioral Fingerprint

This binary is a 1.35 MB PE32 x86 GUI executable compiled with the AutoItSC v3.3.8.1 single-file compiler. It contains a 768 KB encrypted compiled script in the file overlay (not .rsrc) with AU3!EA06 header magic. The import table is dominated by AutoIt runtime APIs: WSOCK32, WININET, ADVAPI32 (registry + token manipulation), GDI32 (screenshot), USER32 (clipboard + keylogging), PSAPI (process enumeration), and ICMP.DLL (host reconnaissance). No .reloc section. Empty VS_VERSIONINFO. Fabricated Jan 2012 PE timestamp. The PCRE regex library error-message table is present in .rdata. No anti-debug or VM checks in the runtime. All threat logic is script-defined and opaque without AutoIt decompilation.

Detection Signatures

References

• Entity page: unclassified-autoit-compiled
• Concept: autoit-compiled-script-dropper
• Technique: autoit-shellcode-xor-decryptor
• Technique: callwindowproc-shellcode-injection
• Technique: process-hollowing
• Triage artifacts: raw/analyses/7bfa4723b2386a09e99d874b7d1da33999c163e6dfab9692ac3c496fc9699e91/

Provenance

• file.txt, strings.txt, pefile.txt, exiftool.json, rabin2-info.txt, capa.txt, floss.txt, binwalk.txt, metadata.json, triage.json — generated by triage-fast pipeline (May 26 2026)
• radare2 analysis: level-3 auto-analysis, 2,514 functions, entrypoint at 0x004165c1
• Overlay inspection and entropy calculation: custom Python (pefile + math), Jul 7 2026
• No dynamic analysis: CAPE skipped — no Windows guest available ^[dynamic-analysis.md]