unclassified-autoit-compiled: c3985bb5 — AutoItSC PE32 with 30-byte XOR shellcode decrypting "myriopodous" inner payload

Executive Summary

AutoItSC single-file compiled dropper (Payment_confirmation_for_IN311197&IN3114590.exe) distributing a 14 KB x86 shellcode stub that builds a 30-byte XOR key on the stack and decrypts a 290 KB inner PE (myriopodous) from %TEMP%. The script uses a "6ddv8" delimiter-obfuscation variant of the cluster's hex-split string encoding. Static-only analysis (CAPE skipped — no Windows guest). Fiftieth confirmed sibling in the unclassified-autoit-compiled cluster.

What It Is

• SHA-256: c3985bb584fce7ef5c6a93908ca54a3c287439a12d9be048c4ead70ddc71eede
• Filename: Payment_confirmation_for_IN311197&IN3114590.exe (payment-confirmation social-engineering lure) ^[metadata.json]
• Size: 1,216,000 bytes (1.16 MB) ^[metadata.json]
• Type: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections ^[file.txt]
• Toolchain: AutoItSC v3 single-file compiler; MSVC 11.0 (VS 2012) linker, MajorLinkerVersion 0xB. Genuine PE timestamp Tue Nov 26 13:34:33 2024 UTC. ^[pefile.txt:1-10]
• Script storage: .rsrc RT_RCDATA with AU3!EA06 header; extracted successfully via autoit-ripper --ea guess. ^[strings.txt]
• VS_VERSIONINFO: Empty (FileVersionMS/LS both 0x0) — cluster norm. ^[pefile.txt]
• Signing: Unsigned. ^[pefile.txt]
• Import surface: Standard AutoItSC runtime (WSOCK32, WININET, ADVAPI32, KERNEL32, GDI32, USER32, OLEAUT32, SHELL32, PSAPI, USERENV, MPR, COMCTL32, WINMM, VERSION, COMDLG32). ^[pefile.txt]

How It Works

1. Outer Dropper (AutoItSC PE)

The binary is a standard AutoItSC v3 single-file PE. On execution the interpreter loads the compiled script from its .rsrc section and begins execution. ^[unclassified-autoit-compiled.md]

2. Script Obfuscation

The extracted script.au3 (2,272 lines, 236 KB) is heavily obfuscated:

• Delimiter stripping: BZAADLRV($JICBQNR, $KMTOSNGREW, $EHDVFGZYVU) at line 2256 strips the literal "6ddv8" delimiter from concatenated strings. ^[script.au3:2256]
• Execute()-based API hiding: API names and parameters are split into fragments and reassembled at runtime via Execute(). Example: "DllStr" & "uctSetD" & "ata(...)". ^[script.au3:1-50]
• Junk/no-op API calls: Hundreds of decoy calls (MsgBox, ToolTip, Ping, FileReadLine with invalid handles, FileExists with fake paths) interleaved with real logic to complicate static analysis. ^[script.au3:100-300]

3. Payload Delivery (ECWFYRWQSR())

Function ECWFYRWQSR() performs the shellcode staging: ^[script.au3:1-8]

1. DllStructCreate("byte[" & BinaryLen($QBCRBMYGX) & "]") — allocates a byte buffer sized to the global payload variable.
2. Execute("DllStructSetData($vretxzba, 1, $qbcrbmygx)") — copies the global hex-encoded payload into the buffer.
3. $VDDBTGJN = Execute("DllStructGetPtr($vretxzba)") — gets a pointer to the buffer.
4. FileInstall("myriopodous", @TempDir & "\myriopodous", 1) — drops the companion encrypted payload to disk. ^[script.au3:5]
5. Obfuscated DllCall("kernel32.dll", "VirtualProtect", ptr $VDDBTGJN, uint BinaryLen($QBCRBMYGX), uint 0x40, ptr* 0) — marks the buffer RWX (0x40). ^[script.au3:6]
6. Execute("DllCallAddress(\"int\", $vddbtgjn + 0x23b0)") — transfers control to the shellcode entry point at offset 0x23B0. ^[script.au3:7]

4. Shellcode Analysis

The $QBCRBMYGX variable is declared on line 9 and extended via &= through ~80 lines. After stripping "6ddv8" and hex-decoding, it yields 14,336 bytes of x86 position-independent code. ^[payload_shellcode.bin]

Disassembly at the entry point (0x23B0 from allocation base): ^[r2:0x100023b0]

• Stack-string key construction: 30 sequential mov byte [ebp+offset], imm8 instructions build the ASCII XOR key 81AP12XJFY5LT6AON7PWXFTL42D29V on the stack. ^[r2:0x100023c2-0x1000249f]
• File I/O: The shellcode calls CreateFileW on %TEMP%\myriopodous, ReadFile into a buffer, then XOR-decrypts in-place using the 30-byte repeating key. ^[r2:0x1000250b-0x1000258d]
• Execution transfer: After decryption, the shellcode transfers execution to the decrypted payload via a call/jmp sequence (exact mechanism not fully traced statically). ^[r2:0x100025ab]

5. Inner Payload (myriopodous decrypted)

The decrypted companion file is a valid PE32 executable (GUI) (290,304 bytes, MD5 31d486e085f72101fc09274f0dc03895): ^[myriopodous_decrypted.bin]

• Timestamp: Mon Oct 26 03:04:11 2015 UTC (static timestamp, likely forged or from a reused builder). ^[r2:iI]
• Characteristics: Static-linked, stripped but not fully, NX enabled, stack canary present. ^[r2:iI]
• Entropy: 7.9649 (full file), indicating heavy packing, encryption, or stripping. ^[entropy-check]
• No recoverable strings and no .NET CLR metadata (BSJB absent), suggesting a native C/C++ compiled payload. ^[strings-check]
• No C2 strings recovered statically from the inner payload.

C2 Infrastructure

No live C2 recovered from the inner payload. The script contains decoy network calls with misspelled protocol (htttp) and invalid parameter counts, confirming they are anti-static noise: ^[script.au3:329,339,621]

• InetRead("htttp://QkHAVTjj.org", 9857, 9009, 9774)
• InetRead("htttp://oKJTzUGtba.com", 611, 412, 2828)
• Ping("htttp://fZHBj04lX.io", 3791, 7734)

Other decoy URLs observed in the script (from broader search): htttp://l0h5Jh0.org, htttp://qI3Betxp9X.com, htttp://mPF2oVSF.io. These are not actionable C2 indicators.

Interesting Tidbits

1. "6ddv8" delimiter variant: A new delimiter in the cluster's hex-split obfuscation family. Previous siblings used 0qk5dd92, 6504, and other tokens; this sample adds 6ddv8. ^[script.au3]
2. 30-byte XOR key: The longest key observed in the cluster to date (previous range: 19–30 bytes; this one hits the ceiling at 30). ^[autoit-shellcode-xor-decryptor.md]
3. Key string pattern: The key 81AP12XJFY5LT6AON7PWXFTL42D29V resembles a serial-number or license-key format — possibly derived from a builder's configuration field.
4. Payment-confirmation lure: Filename Payment_confirmation_for_IN311197&IN3114590.exe uses invoice-number syntax (IN311197, IN3114590) with ampersand, a common procurement/accounts-payable targeting pattern.
5. Anti-forensics registry deletion: RegDelete against HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value "HjR5Yal" and a variable $RGWFVPB suggests cleanup of prior persistence or an attempt to erase competitor malware. ^[script.au3]
6. Process-name checks: Targets processhacker.exe, protools.exe, sgrmbrowser.exe, system_control.exe, xlstart.exe, wsmprovhost.exe — a mix of sysadmin, DAW, and browser process names. ^[script.au3]

How To Mess With It (Homelab Replication)

1. Build an AutoItSC dropper with AutoIt v3.3.8.1+ and the single-file compiler.
2. Obfuscate the script using the "6ddv8" delimiter pattern: split hex payload across $VAR &= "..." lines, inserting "6ddv8" between every two hex digits.
3. Write a BZAADLRV-style stripper that replaces the delimiter with empty string at runtime.
4. Generate x86 shellcode that:
   • Builds a 30-byte ASCII key on the stack via mov byte [ebp+N], imm8
   • Calls CreateFileW → ReadFile → XOR-decrypt loop
   • Verifies MZ header and jumps to payload entry point
5. Encode the shellcode as hex and embed it in the AutoIt $QBCRBMYGX variable.
6. Encrypt the inner payload with the same 30-byte repeating XOR key and embed it as a FileInstall resource named myriopodous.
7. Verification: Run capa on the outer PE — expect the "compiled with AutoIt" limitation warning. Extract script with autoit-ripper, verify AU3!EA06 header, and confirm DllCallAddress at offset 0x23B0.

Deployable Signatures

YARA Rule

rule autoitsc_hexsplit_6ddv8_dropper : autoit loader shellcode {
    meta:
        description = "AutoItSC single-file PE with 6ddv8 delimiter hex-split obfuscation and DllCallAddress shellcode injection"
        author = "PacketPursuit"
        date = "2026-07-18"
        hash = "c3985bb584fce7ef5c6a93908ca54a3c287439a12d9be048c4ead70ddc71eede"
    strings:
        $au3_header = "AU3!EA06"
        $delim = "6ddv8" ascii wide
        $fileinstall = "FileInstall(\"myriopodous\"" ascii wide nocase
        $dllcall = "DllCallAddress" ascii wide nocase
        $virtualprotect = "VirtualProtect" ascii wide nocase
        $regdelete = "RegDelete(\"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and
        $au3_header and
        ($delim or $fileinstall) and
        ($dllcall or $virtualprotect)
}

Behavioral Hunt Query (Sigma-like)

title: AutoItSC myriopodous dropper execution
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - CommandLine|contains: 'myriopodous'
    - CommandLine|contains: 'DllCallAddress'
    - ParentImage|endswith: '\Payment_confirmation_for_IN311197&IN3114590.exe'
  condition: selection
falsepositives:
  - Unknown
level: high

IOC List

Behavioral Fingerprint

This binary is an AutoItSC single-file PE that drops a companion file named myriopodous to %TEMP%, allocates RWX memory for hex-encoded shellcode, and transfers execution via DllCallAddress at offset 0x23B0. The shellcode builds a 30-byte ASCII XOR key on the stack (81AP12XJFY5LT6AON7PWXFTL42D29V), opens the dropped file, and decrypts it in-place before transferring control. The script contains anti-analysis process checks (processhacker.exe, protools.exe) and decoy registry deletions (HKCU\...\Run\HjR5Yal).

Detection Signatures (capa → ATT&CK)

• T1059.005 — Visual Basic (AutoIt script execution) ^[capa.txt]
• T1055 — Process Injection (VirtualProtect RWX + DllCallAddress shellcode injection) ^[script.au3]
• T1027 — Obfuscated Files or Information (hex-split "6ddv8" delimiter obfuscation, junk API calls) ^[script.au3]
• T1497.001 — System Checks (ProcessExists anti-analysis) ^[script.au3]
• T1564.003 — Hide Artifacts (FileInstall to TempDir) ^[script.au3]
• T1070.004 — File Deletion / Indicator Removal (RegDelete of Run keys) ^[script.au3]
• T1547.001 — Registry Run Keys (deletion suggests prior persistence or cleanup) ^[script.au3]

References

• unclassified-autoit-compiled — Cluster entity page (49 prior siblings)
• autoit-hex-split-string-obfuscation — Generic hex-split delimiter-stripping technique
• autoit-shellcode-xor-decryptor — Shellcode XOR-decryptor pattern (19–30 byte keys)
• process-hollowing — Post-decryption injection technique observed in cluster siblings
• social-engineering-filename-lure — Payment-confirmation masquerade pattern

Provenance

• Outer PE analysis: file, exiftool, pefile, rabin2-info, strings, floss, capa, binwalk — all run during triage pipeline.
• Script extraction: autoit-ripper v1.2.0 --ea guess /tmp/c3985bb5...bin wiki/.../c3985bb5/ — succeeded, produced script.au3 and myriopodous.
• Shellcode extraction: Custom Python regex parser accumulating all $QBCRBMYGX quoted strings, stripping "6ddv8", hex-decoding to payload_shellcode.bin (14,336 bytes).
• Shellcode disassembly: r2 -b 32 -a x86 -m 0x10000000 — entry at 0x100023B0, key construction at 0x100023C2.
• Inner payload decryption: XOR with 30-byte repeating key 81AP12XJFY5LT6AON7PWXFTL42D29V → valid PE32 GUI (290 KB), verified with r2 and file.
• Dynamic analysis: Not performed — CAPE skipped (no Windows guest available). All behavioral claims are static inferences.

Report generated 2026-07-18. Static-only analysis. Inner payload attribution pending dynamic detonation or further static unpacking.