unclassified-autoit-compiled: 7c706df3 — REQUEST_FOR_QUOTATION.exe, July 2024 RFQ lure

Executive Summary

Thirty-eighth confirmed sibling in the unclassified-autoit-compiled AutoItSC single-file PE32 cluster. Compiled July 2024 with a Request-for-Quotation social-engineering filename. The 291 KB encrypted AutoIt script is stored in .rsrc (RT_RCDATA ID=SCRIPT) rather than the file overlay. No new obfuscation scheme or payload structure is visible statically; threat logic is locked inside the compiled bytecode. No C2 strings recovered. Static-only — CAPE skipped due to no Windows guest.

What It Is

Family ascription: Confirmed sibling of the unclassified-autoit-compiled cluster. Matches the build fingerprint (AutoItSC v3 single-file PE32, MSVC 12.0 linker, empty VS_VERSIONINFO, script in .rsrc RT_RCDATA, full PCRE regex runtime, standard WinInet/WinSock/ADVAPI32 import surface). The July 2024 PE timestamp and RFQ filename are the per-sample deltas.

How It Works

The binary is a standard AutoItSC (AutoIt Single-File Compiler) output: the AutoIt v3 interpreter runtime is statically linked into a PE32, and the compiled script bytecode is embedded as a resource. At runtime the interpreter decrypts and executes the bytecode. Because capa cannot analyse AutoIt scripts ^[capa.txt], static capability extraction stops at the runtime surface.

Script storage: Resource type RT_RCDATA (10), identifier SCRIPT, language 0, size 291,180 bytes. The first 16 bytes of the resource are a3 48 4b be 98 6c 4a a9 99 4c 53 0a 86 d6 48 7d followed by the plaintext header AU3!EA06M — the AutoIt v3 encrypted-script signature. ^[pefile.txt] ^[binwalk.txt]

Import surface (standard AutoItSC runtime):

• Network: WinInet (HTTP/FTP), WinSock (TCP/UDP/ICMP host resolution), MPR (WNet mapped-drive connections) ^[pefile.txt:373-386] ^[strings.txt:803-843]
• Process / Memory: VirtualAllocEx, WriteProcessMemory, CreateProcessW, OpenProcess, ReadProcessMemory, CreateThread — sufficient for process injection or hollowing if the script demands it ^[strings.txt:896-898]
• Persistence / System: RegSetValueExW, RegCreateKeyExW, CreateDirectoryW, SetFileTime, InitiateSystemShutdownExW ^[strings.txt:1211-1212]
• Reconnaissance: CreateToolhelp32Snapshot, Process32FirstW/NextW, GetSystemInfo, IsWow64Process, GetComputerNameW, GetVolumeInformationW, GetDiskFreeSpaceExW ^[strings.txt:906-957]
• Clipboard / Input: OpenClipboard, GetClipboardData, SetClipboardData, GetAsyncKeyState, SendInput, keybd_event, mouse_event, BlockInput ^[strings.txt:1086-1093]
• GDI / Screenshot: Full GDI32 surface (BitBlt, StretchBlt, GetDIBits, CreateCompatibleBitmap, etc.) ^[strings.txt:1145-1180]
• Token manipulation: AdjustTokenPrivileges, OpenProcessToken, LookupPrivilegeValueW, CreateProcessAsUserW ^[strings.txt:1190-1195]

PCRE regex runtime: The .rdata section contains the complete PCRE 8.x error-message table (numbers out of order in {} quantifier, range out of order in character class, etc.) and a full Unicode script-name table (Arabic, Armenian, Avestan … Warang_Citi). This is a hallmark of the AutoItSC runtime (AutoIt uses PCRE for its StringRegExp function). ^[strings.txt:592-799]

No C2 recovered: There are no hardcoded URLs, IPs, domains, SMTP credentials, or Telegram bot tokens in the PE strings, imports, or resources. The script logic is encrypted/compiled and requires decompilation (e.g., MyAut2Exe or Exe2Aut) to recover. ^[strings.txt] ^[floss.txt]

Decompiled Behavior

Radare2 analysis (level 2, 2551 functions) shows a standard MSVC C++ entry point at 0x0042800a (entry0) with main at 0x0040492e. ^[r2:entrypoints] The binary is not packed. No anti-debug, anti-VM, or obfuscation routines are visible in the compiled runtime — the opaqueness comes entirely from the encrypted AutoIt bytecode in the .rsrc section. No suspicious xrefs to IsDebuggerPresent beyond the benign CRT import. No TLS callbacks. No shellcode stubs in .text or .data.

C2 Infrastructure

None recovered statically. The compiled AutoIt script is encrypted and the bytecode is not directly readable. Decompilation with MyAut2Exe or Exe2Aut would be required to extract C2 endpoints, payload URLs, or mutex names. Dynamic detonation (CAPE) was skipped — no Windows guest available. ^[dynamic-analysis.md]

Interesting Tidbits

• Filename theme: REQUEST_FOR_QUOTATION.exe is a B2B procurement lure — consistent with the cluster's pattern of business-document filenames (invoice, PO, RFQ, SOA, banking, DHL, FDA, salary, etc.).
• VS_VERSIONINFO: Completely empty except for LangID 080904B0 (English British / Unicode). No company name, product name, or version strings. This is standard for the cluster. ^[pefile.txt:230-273]
• Resource entropy: The .rsrc section has entropy 7.96, driven by the encrypted AutoIt script (291 KB) plus four icon resources. ^[pefile.txt:152]
• No UPX: Unlike some cluster siblings (68e48a8c, 6cc26f7c, c310cb2e), this sample is plain (non-UPX). This keeps the 1.11 MB size honest.
• FLOSS failure: The floss pipeline failed with an argument-parsing error (--no flag collision), so no decoded strings were produced. ^[floss.txt]
• YARA: Only generic hits (PE_File_Generic, Suspicious_Wininet_Imports) — no family-specific signatures exist for this cluster. ^[yara.txt]

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.16.1 + SciTE4AutoIt3 on Windows 10/11 x86.

Steps:

1. Write an AutoIt script that uses InetRead, TCPConnect, RegWrite, FileWrite, and MouseClick/Send APIs.
2. Compile with Tools → Compile Script (x86) → "Add x86/x64 resources" unchecked.
3. Verify the output PE32 has:
   • .rsrc section containing RT_RCDATA ID=SCRIPT with AU3!EA06 header
   • Imports from WININET.dll, WSOCK32.dll, ADVAPI32.dll, GDI32.dll
   • Empty VS_VERSIONINFO
4. Run capa — expect the "AutoIt file limitation" warning, same as this sample.

What you'll learn: How the AutoItSC runtime surface looks to static tools, and why capa/FLARE tools must be paired with script decompilers for actual capability extraction.

Deployable Signatures

YARA rule

rule AutoItSC_WinInet_WinSock_RFQ_Lure {
    meta:
        description = "AutoItSC single-file PE32 with WinInet+WinSock imports and encrypted SCRIPT resource"
        author = "PacketPursuit"
        date = "2026-07-07"
        sha256 = "7c706df339eacd86f63c2ccf2aaa4709edaf5edbf24350afa421e3f34eb91a73"
        family = "unclassified-autoit-compiled"
    strings:
        $au3_hdr = { 41 55 33 21 45 41 30 36 }  // "AU3!EA06"
        $pcre_err1 = "numbers out of order in {} quantifier"
        $pcre_err2 = "range out of order in character class"
        $wininet = "WININET.dll" ascii wide
        $wsock32 = "WSOCK32.dll" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections >= 5 and
        $au3_hdr and
        $wininet and
        $wsock32 and
        any of ($pcre_err*)
}

Sigma rule (process creation — behavioral)

title: AutoItSC Compiled Script Execution with Network Activity
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\REQUEST_FOR_QUOTATION.exe'
        CommandLine|contains:
            - 'REQUEST_FOR_QUOTATION'
    network:
        Initiated: 'true'
    condition: selection and network
falsepositives:
    - Legitimate AutoIt automation scripts (rare in enterprise)
level: high

IOC list

Behavioral fingerprint statement

This binary is an AutoItSC single-file PE32 (1.11 MB, MSVC 12.0 linker, July 2024 timestamp). It contains a 291 KB encrypted AutoIt script in RT_RCDATA ID=SCRIPT with an AU3!EA06 header. The import table exposes the full AutoIt runtime surface: WinInet/WinSock for C2, ADVAPI32 for registry persistence and token manipulation, GDI32 for screenshot capture, PSAPI/IPHLPAPI for host reconnaissance, and USERENV for profile loading. No anti-debug or anti-VM is present in the compiled runtime; opaqueness is entirely due to encrypted bytecode. Static analysis alone cannot recover C2 endpoints — decompilation (MyAut2Exe/Exe2Aut) or dynamic detonation is required.

Detection Signatures

References

• unclassified-autoit-compiled — Cluster entity page
• autoit-compiled-script-dropper — Concept page for AutoIt deployment patterns
• Artifact ID: ff3d702d-5080-45ca-aaf3-e5db0aa9e5de
• Source: MalwareBazaar / OpenCTI ingestion

Provenance

Analysis derived from:

• file.txt — file(1) output
• pefile.txt — pefile Python library section/headers/imports dump
• rabin2-info.txt — radare2 binary header summary
• strings.txt — GNU strings extraction (2453 lines)
• floss.txt — FireEye flare-floss (failed, argument error)
• capa.txt — Mandiant flare-capa (AutoIt limitation warning)
• binwalk.txt — binwalk embedded-artefact scan
• yara.txt — YARA rule matches
• exiftool.json — ExifTool metadata
• dynamic-analysis.md — CAPE status (skipped, no Windows guest)
• Radare2 level-2 analysis (2551 functions, entrypoints at 0x0040492e main / 0x0042800a entry0)