unclassified-autoit-compiled: 941a189b — 601 KB overlay-script logistics-tracking lure, VS2010 linker

Executive Summary

AutoItSC v3.3.8.1 single-file PE32 with a 601 KB encrypted script stored in the file overlay (not .rsrc), compiled with the older MSVC 10.0 (VS 2010) linker. Filename 24099762P2024091901KYRQA.exe uses a numeric tracking-code masquerade suggesting logistics or procurement targeting. This is the fifth confirmed sibling in the cluster with overlay script placement, and the twenty-eighth confirmed sibling overall. Full WinInet/WinSock/ADVAPI32/PSAPI/ICMP import surface. No plaintext C2 recovered; threat logic opaque without AutoIt decompilation. Static-only (CAPE skipped — no Windows guest).^[triage.json]^[file.txt]

What It Is

Family attribution is medium-confidence to the unclassified-autoit-compiled cluster based on:

• Identical AutoItSC v3.3.8.1 runtime signature
• Identical AU3!EA06 encrypted script header
• Identical 4-section PE layout (.text, .rdata, .data, .rsrc)
• Full PCRE regex runtime strings in .rsrc ^[strings.txt]
• Standard 16-DLL import surface (WinInet, WinSock, ADVAPI32, GDI32, PSAPI, ICMP, etc.)

How It Works

Script Placement — Overlay, not Resource

Unlike the majority of this cluster (which store the compiled script as resource type 10 / SCRIPT inside .rsrc), this sample places the encrypted bytecode after the last PE section in the file overlay.^[overlay analysis] The overlay begins at file offset 0x9E800 and runs for 601,799 bytes to EOF.^[overlay analysis] The first 64 bytes of the overlay show the standard AutoItSC encrypted header: a3 48 4b be ... AU3!EA06 ....^[overlay analysis] This placement matches five other confirmed siblings: ff84806a, e5647a2d, f346b7e9, d990bd1b6, and a8beee89.^[entities/unclassified-autoit-compiled.md]

Filename Masquerade

The filename 24099762P2024091901KYRQA.exe does not follow the typical business-document patterns (invoice, PO, quotation, SOA) seen in most cluster siblings. Instead it presents as a logistics tracking code with a date stamp (2024091901 = 19 Sep 2024, 01:00 UTC) and an alphanumeric suffix (KYRQA). This suggests targeting of supply-chain or freight-forwarding personnel — a lateral shift in social-engineering theme within the same build pipeline.^[triage.json:5]

Runtime Import Surface

The AutoIt interpreter runtime imports 16 DLLs with ~340 total APIs. The surface is identical to other cluster siblings and provides the script with these capabilities:

Network:

• WinInet: HTTP/HTTPS request/response, FTP file transfer, URL cracking ^[pefile.txt:355-369]
• WinSock: raw TCP/UDP socket creation, send/recv, bind/listen/accept ^[pefile.txt:267-288]
• ICMP: host reachability probing (IcmpCreateFile, IcmpSendEcho) ^[strings.txt:517-520]

Process / Injection:

• CreateProcessW, CreateProcessAsUserW, CreateProcessWithLogonW ^[pefile.txt:503,810-811]
• VirtualAlloc, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory ^[pefile.txt:421-424,506]
• OpenProcess, CreateThread, ResumeThread ^[pefile.txt:421,510,526]
• PSAPI.EnumProcesses, CreateToolhelp32Snapshot / Process32FirstW/NextW ^[pefile.txt:378-379,431-433]

Persistence / Registry:

• RegSetValueExW, RegCreateKeyExW, RegOpenKeyExW, RegDeleteValueW ^[pefile.txt:796-797,824-825]
• AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken ^[pefile.txt:807-808,826]
• LogonUserW, DuplicateTokenEx, LoadUserProfileW ^[pefile.txt:816-817,394]

Collection:

• GDI32: BitBlt, StretchBlt, GetDIBits, CreateCompatibleDC/Bitmap — screenshot capture ^[pefile.txt:741-776]
• USER32: GetAsyncKeyState, GetKeyboardState, GetKeyState — keylogging ^[pefile.txt:643-646]
• USER32: OpenClipboard, GetClipboardData, EmptyClipboard, SetClipboardData — clipboard hijack ^[pefile.txt:696-705]
• USER32: GetCursorPos, SendInput, mouse_event, keybd_event — input injection ^[pefile.txt:630,642,621,729]

Evasion / System:

• IsDebuggerPresent ^[pefile.txt:521]
• GetTickCount, QueryPerformanceCounter/Frequency — timing checks ^[pefile.txt:446,557]
• GetSystemInfo, GetVersionExW — environment fingerprinting ^[pefile.txt:409-410]
• SetSystemPowerState — system shutdown/reboot ^[pefile.txt:561]
• SetErrorMode — suppresses Windows error dialogs ^[pefile.txt:467]

No Anti-Debug in Runtime

The AutoItSC runtime itself does not implement anti-debug or anti-VM checks beyond IsDebuggerPresent. Any anti-analysis behavior lives inside the encrypted script and is not recoverable statically.^[capa.txt]

Decompiled Behavior

Ghidra analysis of the AutoItSC runtime is of limited value — the threat logic is compiled AutoIt bytecode, not native machine code. The entry point at 0x40165C1 initializes the CRT, parses the PE overlay for the encrypted script header, decrypts the bytecode into a memory buffer, and hands control to the AutoIt interpreter loop. The .rsrc section contains AutoIt error-message string tables (e.g., "If statements must have a Then keyword", "Badly formated Struct statement", "Can not redeclare a constant") and a 12-icon suite for GUI masquerade.^[pefile.txt:1412-1456]^[resource analysis]

No decompiled native functions of interest beyond the standard AutoItSC bootstrap. Ghidra was not informative for the actual payload behavior.

C2 Infrastructure

No plaintext C2 strings recovered. The encrypted script overlay contains high-entropy data with no recoverable URLs, IPs, domains, or bot tokens. C2 is either:

1. Hardcoded inside the encrypted script and only visible after AutoIt decompilation, or
2. Built dynamically at runtime from obfuscated fragments.

IOCs from static surface:

• No hardcoded mutex names
• No hardcoded file paths in strings
• No hardcoded registry keys in strings
• No SMTP/FTP credentials in strings
• ICMP reconnaissance capability (no target IP recovered)

Interesting Tidbits

• Overlay placement sub-cluster: This is the fifth sibling with script in overlay (after ff84806a, f346b7e9, e5647a2d, d990bd1b6, a8beee89). All five share the fabricated Jan 2012 PE timestamp and VS 2010/2013-era linkers. The overlay sub-cluster may represent a distinct builder or a specific distributor's preference.^[overlay analysis]
• VS 2010 linker: Most recent cluster siblings use MSVC 12.0–14.x (VS 2013–2019). This sample's MSVC 10.0 linker is the oldest post-2020 build in the corpus, suggesting either deliberate downgrading for compatibility or reuse of an older builder VM.^[pefile.txt:45]
• 12-icon suite in .rsrc: Standard cluster trait — GUI masquerade icons ranging from 16×16 to 256×256. Resource lang 0x809 (British English) is consistent across the cluster.^[resource analysis]
• Full PCRE regex runtime: The embedded PCRE library error messages confirm the interpreter includes pattern-matching capabilities used by script-side data-harvesting (credential regex, file enumeration, etc.).^[strings.txt]
• Filename entropy: KYRQA is a 5-character consonant cluster with no vowels — typical of auto-generated tracking suffixes, increasing the social-engineering plausibility for logistics-sector targets.^[triage.json:5]

How To Mess With It (Homelab Replication)

Toolchain:

• Install AutoIt v3.3.8.1 (or latest v3) from autoitscript.com
• Compile a .au3 script with the single-file compiler: Aut2Exe.exe /in script.au3 /out payload.exe
• The compiler fuses the interpreter runtime (this exact PE signature) with your script

Verification step:

1. Run file payload.exe — should report PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
2. Run capa payload.exe — should flag the AutoIt limitation warning and show the same import surface
3. Run strings payload.exe | grep AU3 — should show AU3!EA06 or similar header marker
4. Compare resource table — should show RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST (no SCRIPT resource if using overlay placement — the AutoItSC default is .rsrc, overlay requires custom build or older compiler)

What you'll learn: The AutoItSC runtime is a legitimate Windows automation framework repurposed by malware actors because it compiles to a standalone PE with built-in obfuscation (encrypted script), full Windows API access via DllCall, and a benign reputation that often evades naive detection.

Deployable Signatures

YARA Rule

rule AutoItSC_v3_SingleFile_PE32_Generic
{
    meta:
        description = "AutoIt v3 single-file compiled PE32 (AutoItSC) — generic cluster detection"
        author = "PacketPursuit SOC"
        date = "2026-07-01"
        hash = "941a189bd84102c13255835bb2f4df77d9cb126be4e54faa179b9de469375fbe"
        reference = "https://www.autoitscript.com/site/autoit/downloads/"
    strings:
        $au3_header = "AU3!EA06" ascii wide
        $au3_support = "AV researchers please email avsupport@autoitscript.com" ascii
        $pcre_utf8 = "this version of PCRE is not compiled with PCRE_UTF8 support" ascii
        $pcre_ucp = "this version of PCRE is not compiled with PCRE_UCP support" ascii
        $wininet = "WININET.dll" ascii
        $wsock32 = "WSOCK32.dll" ascii
        $icmp = "ICMP.DLL" ascii
        $autoit_ver = "AutoIt v3 Script:" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        uint16(uint32(0x3C)+0x14) == 0x00E0 and // Optional header size (PE32)
        filesize < 3MB and
        (
            $au3_header or
            ($au3_support and $autoit_ver)
        ) and
        ($wininet or $wsock32) and
        any of ($pcre*)
}

Sigma Rule

title: AutoItSC Single-File PE32 Execution
description: Detects execution of AutoIt v3 compiled single-file PE32 executables with network and process-injection import surface
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith:
            - '.exe'
        - CommandLine|contains:
            - 'AutoIt'
    condition: selection
falsepositives:
    - Legitimate AutoIt automation scripts in enterprise environments
    - IT administration tools built with AutoIt
level: medium

Note: The above Sigma is intentionally broad. For higher fidelity, tune to the specific filename patterns observed in this cluster: invoice, PO, quotation, SOA, DHL, FDA, banking, shipping, and numeric tracking-code lures.

IOC List

Behavioral Fingerprint Statement

This binary is a 1.25 MB PE32 executable compiled with AutoItSC v3.3.8.1. It has a fabricated January 2012 PE timestamp, an empty VS_VERSIONINFO, and stores its encrypted compiled script in the file overlay (not as an .rsrc resource). The runtime imports 16 Windows DLLs including WinInet, WinSock, ADVAPI32, PSAPI, and ICMP.DLL, providing the embedded script with HTTP/HTTPS/FTP C2, raw socket networking, registry persistence, process enumeration, and host reachability probing. No plaintext C2 strings are recoverable statically — the threat logic is encrypted inside the AutoIt bytecode overlay. Execution begins with standard CRT initialization followed by overlay decryption and interpreter handoff. The .rsrc section contains a 12-icon GUI masquerade suite and AutoIt error-message string tables.

Detection Signatures

References

• unclassified-autoit-compiled — Cluster entity page (28 confirmed siblings)
• autoit-compiled-script-dropper — Concept page covering AutoIt deployment patterns
• AutoIt v3.3.8.1 runtime source: https://www.autoitscript.com/site/autoit/downloads/
• MalwareBazaar: https://bazaar.abuse.ch/sample/941a189bd84102c13255835bb2f4df77d9cb126be4e54faa179b9de469375fbe/
• Artifact ID: 1b360e32-6745-4cc5-9914-aab555457705

Provenance

Analysis produced from static artifacts in raw/analyses/941a189bd84102c13255835bb2f4df77d9cb126be4e54faa179b9de469375fbe/:

• file.txt — file(1) 5.44
• exiftool.json — ExifTool 12.76
• pefile.txt — pefile Python library (full PE headers, imports, resources)
• strings.txt — GNU strings
• rabin2-info.txt — radare2 5.9.0
• capa.txt — flare-capa 7.4.0 (AutoIt limitation warning)
• binwalk.txt — binwalk 2.3.4
• floss.txt — flare-floss (failed: invalid --no argument)
• yara.txt — yara 4.5.0 (PE_File_Generic, Suspicious_Wininet_Imports)
• ssdeep.txt, tlsh.txt, metadata.json, triage.json — triage pipeline outputs
• Custom overlay analysis via Python pefile library and xxd
• dynamic-analysis.md — CAPE skipped (no Windows guest available)