unclassified-autoit-compiled: 891df280 — salary-package .com masquerade, 552 KB encrypted SCRIPT resource

Executive Summary

Single-file AutoItSC PE32 (yoursalarypackage.com) compiled Aug 2024 with a 552 KB encrypted SCRIPT resource in .rsrc. The .com extension masquerades as a domain name rather than a typical document lure. Twenty-first confirmed sibling in the unclassified-autoit-compiled cluster. Static-only analysis (no CAPE Windows guest).

What It Is

Build fingerprint matches the unclassified-autoit-compiled cluster: AutoIt v3 single-file compiler output, 5 standard sections, AU3!EA06 header in compiled script, full PCRE regex runtime strings, and the characteristic 18-DLL import surface covering KERNEL32, ADVAPI32, COMCTL32, COMDLG32, GDI32, IPHLPAPI, MPR, ole32, OLEAUT32, PSAPI, SHELL32, USER32, USERENV, UxTheme, VERSION, WININET, WINMM, and WSOCK32. ^[strings.txt:372-852] ^[capa.txt]

How It Works

The binary is a fused interpreter+script package produced by the AutoIt v3 single-file compiler (AutoItSC). On execution, the embedded AutoIt runtime decrypts and interprets the compiled bytecode stored as an RT_RCDATA resource inside .rsrc. The actual malicious behavior (C2 URLs, payload staging, persistence) is sealed inside the encrypted script and not recoverable without decompilation.

Because this is a cluster sibling, the shared behavior is documented at unclassified-autoit-compiled. Per-sample deltas for 891df280:

• Filename masquerade: yoursalarypackage.com uses a .com extension rather than the typical .exe or double-extension (.pdf.exe, .bat.exe) seen in siblings. On Windows, .com is still a recognized executable extension (DOS compatibility), but to a victim it reads as a website or domain — a payroll/salary lure theme. ^[metadata.json]
• Script size: 552 KB raw in .rsrc — mid-upper range for the cluster (cluster spans 183 KB–932 KB). ^[pefile.txt]
• Build date: Aug 2024, placing it in the same active campaign window as siblings c80ef443, c9c81f5b, and f51bc678. ^[pefile.txt]
• No UPX packing: Unlike siblings c80ef443, 6cc26f7c, and d86e0912, this sample is plain (non-UPX). ^[file.txt]
• No overlay placement: The script lives in .rsrc; siblings ff84806a, f346b7e9, e5647a2d, d990bd1b6, and a8beee89 store the script in the file overlay instead. ^[binwalk.txt]

Decompiled Behavior

Ghidra was not invoked for this analysis. AutoItSC binaries are C++ runtime stubs with minimal native logic; the threat behavior is entirely inside the compiled AutoIt script. Static reverse engineering of the native code would reveal only the standard AutoIt interpreter bootstrap. Decompilation of the script itself requires an AutoIt decompiler (e.g., MyAut2Exe) and is outside the scope of this static-only dive.

C2 Infrastructure

No C2 indicators recovered statically. The AutoItSC runtime imports WinInet (HTTP/FTP) and WinSock (TCP/UDP) APIs, and the script-side logic is encrypted. Any C2 URLs, domains, or IPs are runtime-resolved from the compiled bytecode. ^[strings.txt:1312-1323] ^[pefile.txt]

Interesting Tidbits

• .com extension social engineering: Unlike the invoice/RFQ/FDA/DHL document lures typical of this cluster, the .com extension masquerades as a domain name. A victim scanning their email attachments may mentally parse this as a website link rather than an executable. ^[metadata.json]
• Empty version info: The VS_VERSIONINFO block is structurally present but all fields are zeroed (FileVersion 0.0.0.0, ProductVersion 0.0.0.0), a consistent cluster trait. ^[pefile.txt]
• PCRE regex library: Full Perl Compatible Regular Expressions error-message table and Unicode script-name table are present in .rdata, confirming the AutoIt runtime ships with PCRE for script-side regex operations. ^[strings.txt:568-760]
• YARA hits: PE_File_Generic and Suspicious_Wininet_Imports — generic but consistent with the cluster's network-import surface. ^[yara.txt]
• capa limitation: Mandiant capa correctly identifies the AutoIt compiler and declines further analysis, recommending manual review with an AutoIt decompiler. ^[capa.txt]

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PE32_Cluster
{
    meta:
        description = "AutoIt v3 single-file compiled PE32 cluster fingerprint"
        author = "pp-hermes"
        date = "2026-06-27"
        hash = "891df2806ea7064a2c2c206d6990fb18f8749bb556be5e43af9361f73fd814a0"
    strings:
        $au3_hdr = "AU3!EA06" ascii
        $pcre_err1 = "numbers out of order in {} quantifier" ascii
        $pcre_err2 = "number too big in {} quantifier" ascii
        $pcre_err3 = "missing terminating ] for character class" ascii
        $pcre_err4 = "regular expression is too large" ascii
        $pcre_err5 = "failed to get memory" ascii
        $wininet1 = "InternetOpenW" ascii
        $wininet2 = "HttpSendRequestW" ascii
        $autoit_str = "This is a third-party compiled AutoIt script." ascii
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        uint16(uint32(0x3C)+0x14) == 0x010B and // PE32
        for any i in (0 .. 10) : (pe.sections[i].name == ".rsrc") and
        2 of ($pcre_err*) and
        1 of ($wininet*) and
        ($au3_hdr or $autoit_str)
}

Sigma Rule

title: AutoItSC Single-File PE32 Execution
status: experimental
description: Detects execution of AutoIt v3 single-file compiled PE32 binaries with characteristic network imports
author: pp-hermes
date: 2026-06-27
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'yoursalarypackage.com'
            - 'AUG_SOA.exe'
            - 'Invoice.exe'
            - 'QUOTATION_-_E401723.exe'
            - 'BANK_DETAILS_RO'
            - 'DHL_AWB_TRACKING_DETAILS'
            - 'FDA.exe'
            - 'PO_#86637.exe'
            - 'INQUIRY_2024-SP0006'
            - 'Custom_brief_declaration_notification_for_DHL'
            - 'PO-A1702108.exe'
            - 'PO20240627-001.exe'
            - '#INV-24090166.exe'
            - 'HAWB No Original'
            - 'Public_Holiday_Notice_2024.exe'
            - 'past_years_visit_'
            - 'ITHitech_Park_Project'
            - 'Payment_Reference_SOA'
        ParentImage|endswith:
            - '\explorer.exe'
            - '\outlook.exe'
            - '\winword.exe'
    condition: selection
falsepositives:
    - Legitimate AutoIt-compiled administrative tools (rare)
level: medium

IOC List

Behavioral Fingerprint Statement

This binary is a PE32 x86 GUI executable with five standard sections (.text, .rdata, .data, .rsrc, .reloc) and a large .rsrc section (>500 KB) containing an encrypted RT_RCDATA resource. It imports eighteen Windows DLLs with a heavy focus on WinInet/WinSock networking, ADVAPI32 registry/token manipulation, SHELL32 file operations, and GDI32/UI primitives. The string table contains a complete PCRE regex error-message library and the sentence "This is a third-party compiled AutoIt script." No C2 strings are visible statically; network behavior is runtime-resolved from the compiled script bytecode. The binary is unsigned and carries an empty VS_VERSIONINFO block.

Detection Signatures

References

• Entity page: unclassified-autoit-compiled
• Concept: autoit-compiled-script-dropper
• Source: MalwareBazaar / OpenCTI (artifact f93ce2ab-e89c-41ad-a71a-415e5757df3b)

Provenance

Analysis based on static artifacts in raw/analyses/891df280.../ generated by:

• file v5.44 (file.txt)
• exiftool v12.76 (exiftool.json)
• pefile Python module (pefile.txt)
• strings (strings.txt)
• capa v8.0.1 (capa.txt)
• rabin2 v5.9.8 (rabin2-info.txt)
• binwalk v2.3.2 (binwalk.txt)
• yara v4.5.0 (yara.txt)

CAPE sandbox detonation was skipped due to no available Windows guest machine. All behavioral claims are inferred from imports and static strings.