unclassified-autoit-compiled: c310cb2e — UPX-packed duplicate of e5647a2d invoice-lure

Executive Summary

UPX-packed variant of the already-analyzed unclassified-autoit-compiled sibling e5647a2d (thirteenth confirmed in cluster). Unpacks to identical SHA-256. AutoItSC v3.3.8.1 single-file PE32 with 710 KB encrypted script in overlay, invoice-themed social-engineering lure #INV-24090166.exe. All substantive behavioral and build analysis is shared with e5647a2d; this report exists to close the hash gap.

What It Is

• SHA-256: c310cb2e0a7ae884f2045bd163ab81fbd020d516970510c76897a0836ba4b190
• Original filename: #INV-24090166.exe
• Size: 1,011,883 bytes (988 KB packed) → 1,359,531 bytes (1.33 MB unpacked)
• File type: PE32 executable (GUI) Intel 80386, UPX compressed, 3 sections^[file.txt]
• PE timestamp: Sun Jan 29 21:32:28 2012 UTC (0x4F25BAEC)^[pefile.txt:34]
• Linker: Microsoft linker 10.0 (VS 2010 era)^[pefile.txt:45-46]
• AutoIt version: v3.3.8.1^[exiftool.json]
• Signing: Unsigned^[pefile.txt]
• Packing: UPX 4.2.2-compressed; unpacks to e5647a2d...^[terminal:upx-decompress]

Cluster placement: Twenty-seventh confirmed sibling of unclassified-autoit-compiled. This hash is the packed form; the unpacked payload is byte-for-byte identical to sibling e5647a2d, already analyzed.^[raw/analyses/e5647a2d.../report.md]

How It Works

Build / RE

This binary is the UPX-compressed form of the AutoItSC single-file PE32 described in e5647a2d. The packed file has three sections (UPX0, UPX1, .rsrc) with RWX flags on UPX0 and UPX1^[pefile.txt:3-5]. The .rsrc section (29,696 bytes raw) contains the standard AutoIt runtime resources: 12 RT_ICON entries, RT_MENU, RT_DIALOG, RT_STRING, RT_VERSION, and RT_MANIFEST^[pefile.txt:916-1048]. No SCRIPT resource is present in .rsrc; the compiled script lives in the file overlay.

Unpacking: UPX 4.2.2 decompresses to a 4-section PE32 (.text, .rdata, .data, .rsrc) with SHA-256 e5647a2dedd25289341cc36131ea33f2404e652c38eb81ac4d18f89898a65f04 — identical to the previously analyzed sibling.^[terminal:upx-decompress]

Import surface (packed): The packed IAT is minimal — only KERNEL32.DLL.LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess^[pefile.txt:253-258]. The full AutoIt runtime import surface (WinInet, WinSock, GDI, ADVAPI32, etc.) is restored after decompression and is documented in e5647a2d's report.

capa limitation: capa identified the binary as packed and refused further analysis, recommending unpacking first^[capa.txt]. This is expected; the unpacked payload was already classified as AutoIt by capa's internal limitation rule.^[raw/analyses/e5647a2d/capa.txt]

Deploy / ATT&CK

All TTPs are identical to e5647a2d. The packed form adds no new behavior — it is purely a transport-layer compression. The ATT&CK mappings from e5647a2d apply directly:

Decompiled Behavior

Not performed. The unpacked payload is identical to e5647a2d, whose report explicitly states that decompiling the AutoIt C++ runtime would reveal only the standard library and not the actual malware logic, which lives in the encrypted overlay.^[raw/analyses/e5647a2d/report.md]

C2 Infrastructure

Not recoverable statically. The compiled script is encrypted in the overlay. Network APIs (WinInet, WinSock, ICMP) are available post-unpack. See e5647a2d report for full discussion.^[raw/analyses/e5647a2d/report.md]

Interesting Tidbits

• Hash duplicate: This is the UPX-packed transport form of e5647a2d. Both share the original filename #INV-24090166.exe. The unpacked SHA-256 is e5647a2d....
• UPX ratio: 74.43% compression (1.36 MB → 988 KB)^[terminal:upx-decompress].
• No new behavior: The packing layer adds no anti-analysis, no VM detection, no custom stub — standard UPX 4.2.2 with the default UPX0/UPX1 section names.
• YARA matches: PE_File_Generic, Likely_Packer_UPX^[yara.txt].

How To Mess With It (Homelab Replication)

See e5647a2d report for the full AutoItSC build recipe. To reproduce the packed form specifically:

1. Build an AutoItSC single-file PE as described in e5647a2d's replication notes.
2. Pack with UPX: upx --best test.exe
3. Verify: file test.exe should report UPX compressed; upx -d test.exe should restore the original.
4. Compare capa: packed capa hits packer file limitation; unpacked capa hits compiled AutoIt limitation.

Deployable Signatures

YARA Rule

rule AutoItSC_UPX_Packed_InvoiceOverlay
{
    meta:
        description = "UPX-packed AutoItSC v3 single-file PE32 with large encrypted script overlay"
        author = "PacketPursuit SOC"
        date = "2026-06-30"
        sha256 = "c310cb2e0a7ae884f2045bd163ab81fbd020d516970510c76897a0836ba4b190"
        family = "unclassified-autoit-compiled"
    strings:
        $upx0 = "UPX0" ascii
        $upx1 = "UPX1" ascii
        $au3_header = "AU3!EA06" ascii
        $autoit_err1 = "AutoIt has detected the stack has become corrupt" wide
        $wininet = "WININET.dll" ascii
        $wsock = "WSOCK32.dll" ascii
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        $upx0 and $upx1 and
        $au3_header and
        ($wininet or $wsock) and
        (filesize > 900KB and filesize < 1.5MB)
}

IOC List

Behavioral Fingerprint

UPX-packed AutoItSC v3 single-file PE32. On execution, the UPX stub decompresses the interpreter runtime into memory, which then initializes and decrypts/loads a ~710 KB compiled script payload stored in the file overlay. The runtime exposes the full Windows API surface: WinInet for HTTP/FTP, WinSock for raw TCP/UDP, GDI/USER32 for screen capture and clipboard access, ADVAPI32 for registry manipulation and token privilege escalation, and PSAPI for process enumeration. The script itself is encrypted and not statically analyzable without decompilation. No persistence mechanism is visible in the PE static footprint; any persistence would be enacted by the script at runtime. The binary is unsigned and carries a Jan 2012 PE timestamp with AutoItSC v3.3.8.1 version info. Unpacks to byte-identical SHA-256 e5647a2d....

Detection Signatures (capa → ATT&CK)

capa refused analysis with the packer file limitation rule^[capa.txt]. The unpacked payload hits the compiled AutoIt limitation rule. No ATT&CK mappings from capa.

References

• Artifact ID: 52a20162-c83b-416d-8247-7e529961cd2e (OpenCTI ingestion)
• Source: MalwareBazaar via OpenCTI connector
• Sibling report: unclassified-autoit-compiled entity, e5647a2d analysis^[raw/analyses/e5647a2d.../report.md]
• Cluster entity page: unclassified-autoit-compiled
• Concept page: autoit-compiled-script-dropper

Provenance

Analysis based on:

• file.txt — file(1) output
• exiftool.json — ExifTool 12.76 PE metadata
• pefile.txt — pefile.py full PE dump
• strings.txt — GNU strings -n 4 output
• capa.txt — Mandiant capa v7 (packer limitation warning)
• yara.txt — YARA rules: PE_File_Generic, Likely_Packer_UPX
• ssdeep.txt / tlsh.txt — fuzzy hashes
• rabin2-info.txt — radare2 binary summary
• binwalk.txt — embedded artifact scan
• dynamic-analysis.md — CAPE sandbox status (skipped, no Windows guest)
• Terminal: UPX 4.2.2 decompress, sha256sum verification

All static analysis. No dynamic execution was performed.