unclassified-autoit-compiled: bf0134ff — customer-remittance lure, 249 KB SCRIPT in .rsrc, MSVC 12.0

Executive Summary

A 1.09 MB AutoItSC single-file PE32 (Scanned_Copy_Detailing_Customer_Remittance_and_Overdue_Statement.exe) compiled Jul 2024 with MSVC 12.0 linker. The binary embeds a ~249 KB encrypted AutoIt script in .rsrc (RT_RCDATA type 10) — mid-range size for this 25-sibling cluster. Banking/accounts-receivable social-engineering lure. No plaintext C2, no dynamic detonation (no CAPE Windows guest). Threat logic lives entirely in the encrypted script bytecode; the outer PE is standard AutoIt v3.3.8.1+ interpreter runtime.

What It Is

The compiled AutoIt script resource sits at .rsrc offset 0xD0410 (853,008), size 254,696 bytes (~249 KB). The resource header is encrypted (a3484bbe...), but the AU3!EA06 marker appears inside the .rsrc blob ^[strings.txt:1299] ^[strings.txt:1381] ^[strings.txt:1792], confirming AutoItSC v3.3.8.1+ format. ^[strings.txt:782] ("This is a third-party compiled AutoIt script.")

This sample stores the script in .rsrc (not file overlay), matching the majority of the cluster. Script size is mid-range: larger than the 186 KB ef71e0f6 minimum, smaller than the 932 KB f0059bee maximum.

How It Works

The outer PE is the AutoIt v3 interpreter runtime. On execution it loads the RT_RCDATA resource (type 10), decrypts/decompiles the embedded bytecode, and executes the script. All threat behavior — payload staging, C2, persistence, data theft — lives inside that encrypted script and is opaque to static analysis without an AutoIt decompiler.

For the shared AutoItSC runtime behavior (import surface, PCRE regex library, icon suite, VS_VERSIONINFO pattern), see the unclassified-autoit-compiled entity page. This report focuses on per-sample deltas.

Decompiled Behavior

Ghidra was not run against this sample; radare2 analysis completed (2,645 functions) but the threat logic is not in the native code — it is inside the encrypted AutoIt script resource. Decompilation of the AutoIt runtime itself yields no actionable intelligence beyond confirming the standard AutoItSC entry-point sequence. Static reverse engineering of the script requires MyAut2Exe / Exe2Aut decompilation of the .rsrc payload, which was not performed. ^[dynamic-analysis.md]

C2 Infrastructure

No plaintext C2 strings recovered. No domains, IPs, URLs, mutexes, named pipes, or registry keys visible in static strings. The script is encrypted; C2 is runtime-resolved. This is consistent with the cluster pattern: most siblings hide C2 inside the compiled script.

Interesting Tidbits

• Lure theme: Banking / accounts-receivable — "Customer Remittance and Overdue Statement" masquerades as a scanned financial document, a first for this cluster (previous lures: invoice, payment, shipping, HR, procurement, RFQ, FDA, DHL, banking/SOA, IT-park, salary/payroll). ^[triage.json] ^[metadata.json]
• Build toolchain: MSVC 12.0 linker (VS 2013) — older than the MSVC 14.x (VS 2017–2019) seen in most Jul–Sep 2024 siblings. Only ef71e0f6 (VS 2013), f618a861 (VS 2013), and d990bd1b (VS 2010) use comparably aged linkers. ^[pefile.txt:45-46]
• PE timestamp matches build date: Unlike cluster siblings with fabricated Jan 2012 stamps (ff84806a, f346b7e9, e5647a2d, d990bd1b, fb5bc543, a8beee89), this sample's timestamp aligns with its apparent compile date (Jul 2024). ^[pefile.txt:34]
• Standard PCRE runtime present: Full Unicode script-name table (Tagalog, Tagbanwa, Tai_Le, etc.) and error-message strings confirm the built-in PCRE regex library — common across the cluster. ^[strings.txt:770-781] ^[strings.txt:603] ^[strings.txt:657]
• .rsrc entropy 7.855: Near-maximum entropy in the resource section, driven by the encrypted script blob and compressed icon bitmaps. ^[pefile.txt:152]
• No UPX packing: Plain PE32 (non-UPX), unlike packed siblings fb495efe, 6cc26f7c, d86e0912. ^[file.txt]
• No VS_VERSIONINFO masquerade: Minimal version block (empty strings, 0.0.0.0 versions) — standard for this cluster, not a distinctive trait. ^[pefile.txt:229-273]

How To Mess With It (Homelab Replication)

1. Install AutoIt v3.3.8.1 or later on a Windows VM.
2. Write an AutoIt script that stages a payload (e.g., downloads a second-stage binary, writes it to %TEMP%, and executes via ShellExecute).
3. Compile with Aut2Exe to a single-file PE.
4. Observe the resulting PE: 5 sections, .rsrc containing RT_RCDATA type 10 resource, AU3!EA06 marker inside.
5. Verify with strings: PCRE error messages and Unicode locale table should appear; your plaintext script strings should not.

Verification step: Run capa on the compiled PE — it should flag the AutoIt limitation warning and surface only the runtime import table, not the script logic.

Deployable Signatures

YARA rule

rule AutoItSC_SingleFile_PE32_Generic
{
    meta:
        description = "AutoIt v3 single-file compiled PE32 (AutoItSC) — generic cluster rule"
        author = "pp-hermes"
        family = "unclassified-autoit-compiled"
        reference = "/intel/analyses/bf0134ffa22871a80c7bce17b5c8e258c87d962d20e20b7972702b01aee30c5e.html"
    strings:
        $au3_hdr = "AU3!EA06" ascii
        $au3_msg = "This is a third-party compiled AutoIt script." ascii
        $pcre_err1 = "operand of unlimited repeat could match the empty string" ascii
        $pcre_err2 = "argument is not a compiled regular expression" ascii
        $pcre_locale = "Tagalog" ascii
        $pcre_locale2 = "Tagbanwa" ascii
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 5 and
        pe.imports("WSOCK32.dll") and
        pe.imports("WININET.dll") and
        pe.imports("ADVAPI32.dll") and
        pe.imports("SHELL32.dll") and
        pe.imports("USER32.dll") and
        pe.imports("GDI32.dll") and
        ( $au3_hdr or $au3_msg or
          ( $pcre_err1 and $pcre_err2 and $pcre_locale and $pcre_locale2 )
        )
}

Sigma rule

title: AutoItSC Single-File PE32 Execution
status: experimental
description: Detects execution of AutoIt v3 single-file compiled PE32 (AutoItSC) — generic cluster detection
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - '.exe'
    selection_pe:
        - Image|endswith: '.exe'
    selection_parent:
        ParentImage|endswith:
            - 'explorer.exe'
            - 'wscript.exe'
            - 'cscript.exe'
            - 'cmd.exe'
    selection_autoit_indicators:
        - ImageLoaded|contains:
            - 'WSOCK32.dll'
            - 'WININET.dll'
        - LoadedImage|endswith:
            - 'WSOCK32.dll'
    selection_autoit_strings:
        - Hashes|contains:
            - 'AU3'
    condition: selection and selection_pe and selection_parent and (selection_autoit_indicators or selection_autoit_strings)
falsepositives:
    - Legitimate AutoIt scripts compiled by system administrators
level: medium

Note: Sigma above is illustrative. A more robust behavioral detection targets the parent-child chain (AutoIt3.exe → .a3x) or observes the .rsrc script extraction at runtime. For single-file PEs, memory-analysis YARA against the process .rsrc section is preferred.

IOC list

Behavioral fingerprint

This binary is a standard AutoItSC single-file PE32: five sections, no packing, unsigned, MSVC 12.0 linker, empty VS_VERSIONINFO. The .rsrc section contains a high-entropy (~7.86) encrypted script resource (type 10, RT_RCDATA) of ~249 KB with an AU3!EA06 marker, plus a 9-icon suite. The import table is the full AutoIt runtime surface: WSOCK32, WININET, ADVAPI32, SHELL32, USER32, GDI32, COMCTL32, COMDLG32, MPR, WINMM, PSAPI, IPHLPAPI, USERENV, UxTheme. No plaintext C2, no persistence strings, no mutexes recoverable statically. Threat behavior is entirely script-side and runtime-resolved.

Detection Signatures

All TTPs above are inferred from the AutoIt runtime import table; actual script-side behavior requires dynamic execution or decompilation.

References

• Artifact ID: a0cac956-1a2d-4a36-84f8-de0feabcb148 ^[metadata.json]
• OpenCTI source: MalwareBazaar
• Family entity: unclassified-autoit-compiled
• Concept: autoit-compiled-script-dropper
• Technique: k30zwmbjj-string-obfuscation (observed in other cluster siblings)

Provenance

• file.txt — file v5.41
• exiftool.json — ExifTool v12.76
• pefile.txt — pefile (Python)
• strings.txt — strings (GNU binutils)
• rabin2-info.txt — radare2 v5.x
• binwalk.txt — binwalk v2.3.3
• capa.txt — Mandiant FLARE capa v7.x
• triage.json — triage-fast pipeline
• metadata.json — corpus metadata
• ssdeep.txt / tlsh.txt — fuzzy hash tools
• radare2 analysis — 2,645 functions, entrypoint 0x0042800a

Static-only analysis. No CAPE detonation available (no Windows guest). Script behavior inferred from cluster patterns and AutoIt runtime imports.