formbook: a4cb4c76 — AutoIt dropper with PFMD87JH468RAUYH XOR key and shellcode bootstrap

Executive Summary: A single-file AutoIt3-compiled PE dropper that uses a two-stage payload delivery: a 14 KB x86 shellcode bootstrap (bohmite) allocates RWX memory and transfers control at offset +9136, while a 288 KB XOR-obfuscated PE (pteropod) is decoded in-memory using the hardcoded key PFMD87JH468RAUYH. The outer AutoIt layer hides all API names behind a delimiter-stripping + string-reversal obfuscation scheme. No CAPE detonation available; analysis is static-only.

What It Is

• File: a4cb4c76933ac72570a90a7bb73c6dc6cdc791db10697aa10bf70dec8835e53c.bin ^[file.txt]
• Size: 1,225,216 bytes (1.17 MB) ^[rabin2-info.txt]
• Format: PE32 executable (GUI) Intel 80386, 5 sections ^[file.txt]
• Compiled: 2024-09-02 02:37:34 UTC ^[rabin2-info.txt]
• Language: AutoIt3-compiled script (single-file .exe with interpreter embedded) ^[capa.txt]
• Signer: Unsigned ^[rabin2-info.txt]
• NX/DEP: Disabled (nx: false) ^[rabin2-info.txt]
• Stack canary: Present (canary: true) ^[rabin2-info.txt]
• Family: Preliminary tag formbook from triage; this sample is an AutoIt dropper delivering a native PE payload via shellcode bootstrap. Medium-confidence attribution.

How It Works

1. AutoIt script extraction. The compiled script lives in .rsrc section type 10 (RT_RCDATA, size 334,658 bytes). autoit-ripper extracts the plaintext script and two embedded files: pteropod (288,256 bytes) and bohmite (143,370 bytes). ^[script.au3]
2. Obfuscation layer. All API names and constants are encoded with a delimiter (6504) inserted between characters, then the entire string is reversed. The master decoder B30VDMCF strips the delimiter and reverses back to plaintext. ^[script.au3:1–36]
3. Payload staging. The script drops both files to @TempDir, reads bohmite, decodes it, allocates executable memory via VirtualAlloc (obfuscated name c6504o6504l6504l6504A6504...), copies the decoded shellcode into a DllStruct, and transfers control with DllCallAddress(... + 9136). ^[script.au3:29–36]
4. Shellcode bootstrap. The decoded bohmite is 14,336 bytes of x86 code starting with push ebp / mov ebp, esp. Entry point at offset 9136 (also push ebp / mov ebp, esp). Its purpose is to decode and map the pteropod payload into memory. ^[bohmite_shellcode.bin]
5. Inner payload (pteropod). The 288 KB file is XOR-decoded in-memory using the 16-byte key PFMD87JH468RAUYH (visible as a stack-initialized string in the shellcode at 0x23b0). ^[r2:fcn.000023b0] The decoded payload is a PE32 executable with a single .text section (entropy 7.996), no imports, no exports, compiled 2016-08-14 05:37:59 UTC. ^[pteropod_decoded.bin]

Decompiled Behavior

Outer PE (AutoIt interpreter)

The AutoIt-compiled PE is a standard AutoIt3 single-file executable. Its .rsrc section contains the compiled script and embedded file payloads. No custom packer or crypter is present on the outer layer — the obfuscation is entirely in the AutoIt script itself. ^[capa.txt]

Shellcode bootstrap (bohmite)

Radare2 decompilation of the shellcode entry (0x23b0) shows:

• Stack frame setup (push ebp; mov ebp, esp; sub esp, 0x3c0)
• The 16-byte XOR key PFMD87JH468RAUYH is built byte-by-byte on the stack
• The string "pteropod" is assembled on the stack
• CreateFileA / ReadFile pattern is implied by the API call chain (0xffffffffffffff90, 0xffffffffffffff94, etc.)
• VirtualAlloc is called with 0x3000 (MEM_COMMIT | MEM_RESERVE) and 0x40 (PAGE_EXECUTE_READWRITE)
• A secondary function (fcn.000022e0) performs the XOR decode loop
• The decoded payload is then executed via a call to fcn.000012a0 ^[r2:fcn.000023b0]

Inner payload (pteropod decoded)

• Machine: i386 ^[rabin2-info.txt]
• Subsystem: Windows GUI ^[rabin2-info.txt]
• Sections: Single .text section, raw size 283,648, virtual size 283,572, entropy 7.996 ^[pteropod_decoded.bin]
• Imports: None (zero IAT) ^[rabin2-info.txt]
• Exports: None ^[rabin2-info.txt]
• Strings: 54 strings total, all high-entropy garbage (e.g. AO(x<MVb, T7?bl\o0). No C2 URLs, no registry keys, no file paths. ^[pteropod_strings.txt]
• Signing: Unsigned ^[rabin2-info.txt]
• Compiler: C (language field in rabin2) ^[rabin2-info.txt]

C2 Infrastructure

No observable C2 in static analysis. The decoded inner payload has zero imports, zero exports, and no meaningful strings. All network indicators (if any) are likely resolved at runtime via PEB walking or embedded in an additional encoding layer not recoverable statically. ^[pteropod_strings.txt]

Interesting Tidbits

• Compiler time gap. Outer AutoIt PE compiled 2024-09-02; inner payload compiled 2016-08-14 — an 8-year gap suggesting the inner payload is a reused or stock component. ^[rabin2-info.txt]
• XOR key as stack string. The key PFMD87JH468RAUYH is not stored as a contiguous string in the shellcode; it is built byte-by-byte via mov byte [var_XX], 0xYY instructions, a common anti-string-analysis technique. ^[r2:fcn.000023b0]
• Inner payload is import-less. The 288 KB PE has no IAT. It must resolve all APIs at runtime via PEB walking, hash-based lookup, or similar shellcode-style technique. This is consistent with reflective injection payloads. ^[rabin2-info.txt]
• High entropy across all layers. Outer PE entropy is high due to embedded AutoIt script; inner payload entropy is 7.996 (near-random) even after XOR decode, suggesting additional encryption or compression inside the .text section. ^[pteropod_decoded.bin]
• No CAPE detonation. The sample was skipped because no Windows CAPE guest was available. All behavior claims above are static-only inferences. ^[dynamic-analysis.md]

How To Mess With It (Homelab Replication)

Reproduce the AutoIt obfuscation

1. Install AutoIt3 on a Windows VM.
2. Write a script that encodes a string by inserting 6504 between characters and reversing:

   $encoded = StringReverse(StringReplace("kernel32", "", "6504", 0, 1))
   

3. At runtime, decode with:

   $decoded = StringReverse(StringReplace($encoded, "6504", ""))
   

4. Compile to .exe with AutoIt3 compiler.
5. Verify: run strings on the compiled PE — "kernel32" should not appear.

Reproduce the XOR payload decode

1. Take any PE file and XOR it with the key PFMD87JH468RAUYH (repeating 16-byte block).
2. Write a C loader that initializes the key on the stack (byte-by-byte mov instructions) and decodes the payload in RWX memory.
3. Execute with ((void(*)())alloc_addr)().

Deployable Signatures

YARA Rule

rule Formbook_AutoIt_Dropper_A4CB4C76
{
    meta:
        description = "AutoIt-compiled Formbook dropper with PFMD87JH468RAUYH XOR key"
        author = "PacketPursuit"
        date = "2026-06-27"
        sha256 = "a4cb4c76933ac72570a90a7bb73c6dc6cdc791db10697aa10bf70dec8835e53c"
    strings:
        $autoit_marker = "AutoItSC" ascii
        $delimiter = "6504" ascii wide
        $xork = "PFMD87JH468RAUYH" ascii
        $pteropod = "pteropod" ascii
        $bohmite = "bohmite" ascii
        $virtualalloc_obf = "c6504o6504l6504l6504A6504l6504a6504u6504t6504r6504i6504V6504" ascii
    condition:
        uint16(0) == 0x5a4d and
        $autoit_marker and
        ($delimiter or $xork or $pteropod or $bohmite or $virtualalloc_obf)
}

Behavioral Fingerprint

This binary is an AutoIt3-compiled PE that drops two files to %TEMP% — one named pteropod and one named bohmite. It allocates RWX memory via VirtualAlloc, copies decoded shellcode into it, and transfers execution at a fixed offset (+9136). The shellcode decodes a second PE payload in-memory using a 16-byte XOR key built byte-by-byte on the stack. The final payload is a single-section import-less PE that must resolve its own APIs at runtime. No registry persistence or network activity is observable in static analysis.

IOC List

Detection Signatures

References

• formbook — family entity page
• autoit-compiled-script-dropper — delivery mechanism concept
• autoit-delimiter-reverse-obfuscation — obfuscation technique
• Sample source: MalwareBazaar / OpenCTI ingestion pipeline
• SHA-256: a4cb4c76933ac72570a90a7bb73c6dc6cdc791db10697aa10bf70dec8835e53c

Provenance

• file.txt — file command output (file type identification)
• rabin2-info.txt — radare2 binary header summary (architecture, compilation timestamp, security features)
• capa.txt — Mandiant flare-capa capability detection (AutoIt compilation rule)
• script.au3 — AutoIt decompiler output (autoit-ripper v2.0.1)
• bohmite_shellcode.bin — decoded shellcode payload (14,336 bytes, decoded via replace('6504','')[::-1] then unhexlify)
• pteropod_decoded.bin — XOR-decoded inner PE (288,256 bytes, key PFMD87JH468RAUYH)
• pteropod_strings.txt — strings -n 8 output from decoded PE
• dynamic-analysis.md — CAPE sandbox status (skipped, no Windows guest)
• radare2 v5.9.8 — shellcode decompilation at 0x23b0