SHA-256: aa4d237c7a9b4ec7915c582ad703c886422d59ceb40ded57307d7da15ec9bfc8

unclassified-autoit-compiled: aa4d237c — three-stage reflective loader with XOR-encrypted MZ payload

Executive Summary: AutoItSC v3.3.8.1 single-file PE32 with Aug 2024 build timestamp. Drops two embedded resources (endochylous, contrapose) to %TEMP%, then decrypts and executes contrapose as shellcode; the shellcode in turn decrypts and reflectively loads endochylous (an XOR-encrypted MZ/PE). Static-only; CAPE skipped. Twenty-third confirmed sibling in the unclassified-autoit-compiled cluster.

What It Is

File: CF-INV._233348900RFP.exe — procurement/invoice lure ^[file.txt]
Build: PE32 x86 GUI, MSVC 14.16 linker, compiled Fri Aug 2 11:32:33 2024 UTC ^[rabin2-info.txt], unsigned, empty VS_VERSIONINFO ^[pefile.txt]
Framework: AutoItSC v3.3.8.1 single-file compiled PE32; AU3!EA06 header in .rsrc SCRIPT resource ^[strings.txt:1340], AU3!EA06 marker in overlay ^[strings.txt:1772]
Cluster: Twenty-third confirmed sibling of unclassified-autoit-compiled; follows identical build fingerprint (MSVC 14.x, 5-section PE32, full WinInet/WinSock/ADVAPI32/GDI import surface, PCRE regex runtime)

How It Works

The compiled AutoIt script performs a three-stage execution chain:

Stage 1 — AutoIt PE bootstrap: FileInstall drops endochylous and contrapose to @TempDir. ^[script.au3:1-2]
Stage 2 — Shellcode injection: Opens contrapose, reads contents, decrypts with custom O30MJJHT Caesar-5 string obfuscation (key = 5), allocates executable memory via VirtualAlloc (fl PAGE_EXECUTE_READWRITE = 0x40), and jumps to offset +9136 via DllCallAddress. ^[script.au3:3-16]
Stage 3 — Reflective PE loading: The contrapose shellcode (14 KB, x86 position-independent) reads endochylous, XOR-decrypts it with repeating key "WH" (derived from hardcoded string "WHEDKUU9DGD4010E8IHWHEDK" in shellcode ^[ghidra:fcn.000023b0]), parses DOS/NT headers, copies sections into RWX memory, resolves imports via IAT walking, fixes relocations, and transfers execution. ^[r2:fcn.00002050]

The script wraps the injection in heavy junk-code obfuscation: 600 iterations of random AutoIt API calls (MouseClick, WinGetPos, PixelSearch, EnvSet, etc.) with garbage string parameters, creating control-flow noise. ^[script.au3:17-500]

Decompiled Behavior

The contrapose shellcode was analyzed via radare2. Key functions:

fcn.000023b0 — main loader: constructs "endochylous" filename, opens file, reads into heap buffer, calls decryption + PE mapping chain.
fcn.00002050 — PE mapper: parses DOS header → e_lfanew → NT headers → section table; allocates RWX memory (VirtualAlloc 0x3000, 0x40); copies sections; resolves imports via LoadLibraryA/GetProcAddress; processes relocation table.
fcn.00001eb0 / fcn.00001e90 — execution context setup and entry-point transfer.

No anti-debug or VM checks observed in either the AutoIt runtime or the shellcode.

C2 Infrastructure

None recovered statically. The AutoIt script contains no plaintext URLs, IPs, or domains. The endochylous payload decrypts to a ~275 KB MZ/PE (DOS stub + unknown headers), but no C2 strings are visible in the decrypted blob. C2 is likely runtime-resolved by the final payload.

Interesting Tidbits

Dual-file drop: Unlike siblings a8beee89 (VirtualProtect+CallWindowProc direct from script) or 891df280 (disk drop only), this sample uses a dedicated shellcode loader (contrapose) as an intermediary — a more modular design that separates loader logic from payload.
Key derivation: The XOR key "WHEDKUU9DGD4010E8IHWHEDK" is assembled on the shellcode stack byte-by-byte, not stored as a contiguous string in the binary — a mild anti-static measure.
Filename lure: CF-INV._233348900RFP.exe mimics a corporate Request-for-Procurement document with an underscore-prefix obfuscation to evade naive filename filters.
Junk code density: ~80% of the decompiled script is dead code; the real payload logic is concentrated in the first 16 lines.

How To Mess With It

Extract the compiled script: autoit-ripper <sample> <outdir> — produces script.au3, endochylous, contrapose.
Decrypt contrapose: XOR each byte with 0x05 (Caesar-5 from O30MJJHT), then hex-decode to obtain shellcode binary.
Decrypt endochylous: XOR with repeating key "WH" (or full "WHEDKUU9DGD4010E8IHWHEDK").
Load shellcode in x86 radare2 (r2 -b 32) at base 0x10000000 and trace fcn.000023b0 to observe PE mapping.

Deployable Signatures

YARA rule:

rule AutoIt_ReflectiveLoader_DualDrop {
    meta:
        description = "AutoItSC PE dropping endochylous+contrapose reflective loader pair"
        family = "unclassified-autoit-compiled"
    strings:
        $au3 = "AU3!EA06"
        $end = "endochylous" nocase
        $ctr = "contrapose" nocase
        $func = "O30MJJHT" nocase
        $key1 = "WHEDKUU9DGD4010E8IH"
    condition:
        uint16(0) == 0x5A4D and
        $au3 and
        2 of ($end, $ctr, $func, $key1)
}

IOC list:

SHA-256: aa4d237c7a9b4ec7915c582ad703c886422d59ceb40ded57307d7da15ec9bfc8
SHA-256 (contrapose): 7a64e9bed83669cb1464094f3d5109a082a24b1ca9a0ea709a2a1692a97dd2bf
SHA-256 (endochylous): 5263d1df9147889c0abe47b8503e696055600b202a9ba5a44ffc2473a14f5811
SHA-256 (endochylous decrypted): b5e5cde13cd41bc79b3a81b4602beacd6ab6bb0391a984a8f87feeccbfdce299
Filename: CF-INV._233348900RFP.exe
Temp paths: %TEMP%\endochylous, %TEMP%\contrapose
XOR keys: 5 (contrapose), "WH" (endochylous)

Behavioral fingerprint: AutoIt-compiled PE32 drops two files to %TEMP% with 14+ character pseudo-random lowercase names, opens one via CreateFileW with GENERIC_READ, allocates RWX memory via VirtualAlloc, and transfers control to an offset >9000 bytes into the decrypted buffer within 5 seconds of process start.

Detection Signatures

T1059.005 — Command and Scripting Interpreter: AutoIt
T1055 — Process Injection (reflective PE loading via VirtualAlloc + manual mapping)
T1027.002 — Obfuscated Files or Information: Software Packing (compiled AutoIt bytecode)
T1071.001 — Application Layer Protocol: Web Protocols (WinInet surface present but C2 unobserved)

References

Analysis directory: raw/analyses/aa4d237c7a9b4ec7915c582ad703c886422d59ceb40ded57307d7da15ec9bfc8/
Cluster entity: unclassified-autoit-compiled
Concept: autoit-compiled-script-dropper

Provenance

Static analysis performed on 2026-06-27. Tools: file(1), exiftool, pefile, radare2 (aaa level 3), autoit-ripper v1.2.0, Python manual decryption. CAPE dynamic analysis skipped — no Windows guest available. ^[dynamic-analysis.md]

> Analysis · aa4d237c7a9b_