Deep Analysis: a8beee89eb72

Executive Summary

AutoItSC v3.3.8.1 single-file compiled PE32 with script stored in file overlay (not .rsrc). Decompiled script reveals a two-path payload delivery: a 274 KB hex-encoded file dropped to %TEMP%\resharpen, and a second hex-encoded block injected directly into executable memory via VirtualProtect → CallWindowProc. All string literals are obfuscated via a custom TIYHOWEDON function that strips the junk substring wqdfrowv. Static-only; no CAPE behavioral ground-truth. Low confidence.

1. Build / RE

Toolchain & Outer PE

• Format: PE32 executable (GUI) Intel 80386, 4 sections^[file.txt]
• Compiler / Linker: MSVC 10.0 (Visual Studio 2010) — consistent with AutoItSC v3.3.8.1 runtime^[pefile.txt:34]
• Timestamp: Sun Jan 29 21:32:28 2012 UTC — the v3.3.8.1 release epoch; not a meaningful compile date^[rabin2-info.txt:11]
• Script placement: File overlay (after last PE section), not .rsrc — a minority placement in the cluster shared with ff84806a, e5647a2d, d990bd1b6, f346b7e9^[pefile.txt:76]
• Signing: Unsigned^[rabin2-info.txt:27]
• Packing: None (not UPX); entropy of outer PE sections within normal range for AutoItSC runtime

AutoIt Script Extraction

• Tool: autoit-ripper v2.0.0 successfully extracted the compiled .au3 source from the file overlay.
• Decompiled size: ~1,300 lines of heavily obfuscated AutoIt3 BASIC.
• Tray icon: Suppressed via #NoTrayIcon at line 1^[script.au3:1]

String Obfuscation — TIYHOWEDON

• Mechanism: Every string literal is wrapped in TIYHOWEDON("..."). The function prepends the junk token wqdfrowv to each character of the real string, then StringReplace strips it out at runtime^[script.au3:8978]^[script.au3:1247].
• Decoded API names recovered: kernel32.dll, user32.dll, VirtualProtect, CallWindowProc, byte[], bool, uint, ptr^[script.au3:8978]
• Network / path strings: No plaintext C2 URLs, IPs, or domain names recovered after decoding.

Payload A — $EFDJELXBS (Disk Drop)

• Size: ~274,432 bytes (548,864 hex characters concatenated across lines 2–848)^[script.au3:2]
• Encoding: Hex string ("0x..." prefix, then &= concatenation)
• Entropy: 6.8983 — well above random, indicating compressed/encrypted payload^[triage.json]
• Decryption attempts: Single-byte XOR brute force (0x00–0xFF) produced no valid PE header, no PK ZIP signature, and no >80 % printable plaintext in the first 2,000 bytes. No repeating XOR key pattern identified. Algorithm unknown.
• Drop path: @TempDir & "\resharpen" (file mode 18 = binary overwrite)^[script.au3:1244]

Payload B — $TWUOSLLNJT (Memory Injection)

• Size: ~30,720 bytes (61,440 hex characters)^[script.au3:849]
• Encoding: Same hex-string concatenation, then passed through TIYHOWEDON for decode^[script.au3:1247]
• Injection chain:
  1. DllStructCreate("byte[" & BinaryLen($TWUOSLLNJT) & "]") allocates a raw buffer^[script.au3:1248]
  2. DllStructSetData copies decoded shellcode into the buffer^[script.au3:1249]
  3. DllStructGetPtr retrieves the buffer pointer ($ZOILLAJ)^[script.au3:1250]
  4. DllCall("kernel32.dll", "VirtualProtect", ...) marks the region executable^[script.au3:1251]
  5. DllCall("user32.dll", "CallWindowProc", ptr, $ZOILLAJ + 9120, ...) transfers execution to offset 0x23A0 inside the shellcode^[script.au3:1252]
• Entry-point disassembly (offset 9120, x86-32): Standard stack-frame setup (push ebp; mov ebp, esp; sub esp, 0x3C8), followed by byte-by-byte construction of the ASCII string H4KN9J2TY5GMIP9WAPZ602H4... on the stack — another layer of runtime string decoding within the shellcode itself^[TWUOSLLNJT.bin:0x23A0].
• Further analysis blocked: Without a full disassembler (Capstone unavailable) or CAPE detonation, the inner shellcode behaviour beyond the entry prologue cannot be resolved statically.

Anti-Analysis

• Debugger / VM checks: None observed in decompiled script.
• Anti-disassembly: Natural consequence of compiled AutoIt bytecode; autoit-ripper was required.
• String obfuscation: TIYHOWEDON junk-string stripping adds trivial static friction.

2. Deploy / ATT&CK

Inferred TTPs (all static — no CAPE ground-truth)

Persistence

• None directly observed in decompiled script. The outer PE import table includes ADVAPI32.dll (RegSetValueExW, RegCreateKeyExW) and KERNEL32.dll (WritePrivateProfileSectionW), which are standard AutoItSC runtime imports and do not confirm malicious registry use in this sample.

C2 / Network

• No network IOCs recovered from decompiled strings. The WSOCK32 + WININET import surface confirms network capability but provides no static destination. The shellcode entry point constructs obfuscated strings on-stack, suggesting C2 configuration or API names may be decoded at runtime.

Attribution

• Family: unclassified-autoit-compiled — matches the AutoItSC v3.3.8.1 overlay-script cluster (shared with ff84806a, e5647a2d, d990bd1b6).
• Attribution: None. No linguistic markers, no infrastructure overlap, no code-reuse signatures against known families.
• Confidence: Low. Static-only; payload decryption unsuccessful; inner shellcode not fully disassembled.

3. Artifacts Summary

4. Recommendations for Follow-Up

1. Re-run autoit-ripper with decryption plugins if newer versions support the AU3!EA06 bytecode encryption used by v3.3.8.1 — the script source is fully recovered but payload blobs are opaque.
2. Dynamic detonation on a live Windows sandbox with API hooking (NtAllocateVirtualMemory, NtProtectVirtualMemory, CreateProcess) to observe the shellcode's runtime imports and network connections.
3. YARA hunt for the TIYHOWEDON function name or the wqdfrowv junk token across the corpus — this obfuscation pattern may link siblings not yet clustered.