unclassified-autoit-compiled: c6c17d403f4d — Fifty-first confirmed sibling, Nov 2024 build, procurement-filename lure

Executive Summary

AutoItSC v3.3.8.1 single-file PE32 (Approved_686777-707987-098879896886.exe) compiled Nov 2024 with MSVC 11.0 (VS 2012) linker — the first sibling in the cluster with a genuine post-Nov 2024 PE timestamp. 344 KB encrypted SCRIPT resource in .rsrc (entropy 7.999). Empty VS_VERSIONINFO, 11-icon suite, full PCRE regex runtime, standard AutoItSC import surface. No plaintext C2, payload filenames, or shellcode strings recovered. Static-only analysis.

What It Is

• SHA-256: c6c17d403f4d42946bee192df3559fb09087f030ffcc7c41d73b9fee76eb547b ^[file.txt]
• Size: 1,212,416 bytes (1.16 MB) ^[triage.json]
• Filename: Approved_686777-707987-098879896886.exe ^[triage.json]
• File type: PE32 executable (GUI) Intel 80386, 5 sections ^[file.txt]
• Compilation timestamp: Wed Nov 20 23:36:38 2024 UTC ^[rabin2-info.txt]
• Linker: Microsoft linker 11.0 (Visual Studio 2012) ^[exiftool.json]
• Subsystem: Windows GUI ^[exiftool.json]
• Signing: Unsigned ^[rabin2-info.txt]
• ASLR: Enabled (DYNAMIC_BASE) ^[pefile.txt:74]
• NX: Disabled (nx: false) ^[rabin2-info.txt:24]

This is the fifty-first confirmed sibling in the unclassified-autoit-compiled cluster. It is the first sibling observed with a genuine post-Nov 2024 compilation timestamp; previous siblings span Jul 2024–Oct 2024 with the exception of fabricated Jan 2012 timestamps on overlay-script variants.

How It Works

Build / RE

The binary is a standard AutoItSC v3.3.8.1 single-file PE32 output: the AutoIt interpreter runtime (compiled C/C++) fused with an encrypted compiled-script payload. ^[capa.txt]

Sections (5): ^[pefile.txt:76]

The .rsrc section entropy of 7.90 is driven by the encrypted SCRIPT payload; the icon resources are small by comparison.

SCRIPT resource (RT_RCDATA ID=SCRIPT): 352,643 bytes. Header: a3 48 4b be ... with AU3!EA06 marker at offset 16 — the standard AutoItSC compiled-script signature. ^[pefile.txt:956] The script body is encrypted/compiled bytecode; no plaintext strings recoverable without decompilation.

Version info: Empty VS_VERSIONINFO — CompanyName, FileVersion, ProductVersion all zeroed. ^[pefile.txt:229] Only the LangID (080904B0, British English) and CharacterSet (Unicode) are populated. ^[exiftool.json:34]

Icon suite: 11 RT_ICON entries in .rsrc (IDs 1–11) with 4 RT_GROUP_ICON entries (IDs 7, 8, 9, 10). ^[pefile.txt:965] The icons have not been extracted for visual analysis.

Import surface — standard AutoItSC runtime profile: ^[pefile.txt:274]

• WSOCK32.dll (22 ordinals): full WinSock 1.1 surface (socket, connect, send, recv, bind, listen, accept, select, WSAStartup, gethostbyname, inet_addr, etc.)
• WININET.dll (14 imports): InternetOpenW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, InternetOpenUrlW, InternetReadFile, FtpOpenFileW, etc.
• KERNEL32.dll (~120 imports): full Win32 API surface including VirtualAlloc, CreateProcessW, WriteProcessMemory, ReadProcessMemory, OpenProcess, HeapAlloc, LoadLibraryA, GetProcAddress, FindResourceW, LoadResource, CreateToolhelp32Snapshot, Process32FirstW/NextW, IsDebuggerPresent, etc.
• USER32.dll (~150 imports): windowing, keyboard (GetAsyncKeyState, keybd_event, SendInput), clipboard (OpenClipboard, GetClipboardData, SetClipboardData), screen capture primitives (GetDC, ReleaseDC, BeginPaint, EndPaint)
• GDI32.dll (~40 imports): drawing, bitmap, screen capture (GetDIBits, StretchBlt, CreateCompatibleDC, CreateCompatibleBitmap)
• ADVAPI32.dll (~30 imports): registry (RegSetValueExW, RegCreateKeyExW, RegOpenKeyExW, RegEnumKeyExW), token manipulation (OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW), process creation as user (CreateProcessAsUserW, CreateProcessWithLogonW, LogonUserW)
• SHELL32.dll (~15 imports): ShellExecuteW, ShellExecuteExW, SHGetFolderPathW, SHBrowseForFolderW, ExtractIconExW
• MPR.dll (4 imports): WNetAddConnection2W, WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW
• IPHLPAPI.DLL (3 imports): IcmpCreateFile, IcmpSendEcho, IcmpCloseHandle
• PSAPI.DLL (1 import): GetProcessMemoryInfo
• USERENV.dll (4 imports): LoadUserProfileW, UnloadUserProfile, CreateEnvironmentBlock, DestroyEnvironmentBlock
• UxTheme.dll (1 import): IsThemeActive
• VERSION.dll (3 imports): GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
• WINMM.dll (3 imports): timeGetTime, waveOutSetVolume, mciSendStringW
• COMCTL32.dll (~10 imports): ImageList_* surface, InitCommonControlsEx
• COMDLG32.dll (2 imports): GetOpenFileNameW, GetSaveFileNameW
• ole32.dll (~20 imports): COM/OLE automation surface
• OLEAUT32.dll (~30 ordinals): Variant, SafeArray, BSTR, DispCallFunc

The import surface is identical in shape to every other sibling in the cluster — the AutoItSC runtime is a fixed binary blob, and the only variance is the encrypted script payload.

PCRE regex runtime: Present, evidenced by error-message strings ("missing terminating ] for character class", "reference to non-existent subpattern", "this version of PCRE is compiled without UTF support", "recursive call could loop indefinitely", "syntax error in subpattern name", etc.) ^[strings.txt:583] and Unicode script-name table (Inscriptional_Pahlavi, Inscriptional_Parthian, Sharada, Shavian, Tagalog, etc.). ^[strings.txt:695] The PCRE runtime is a standard component of AutoItSC v3.3.8.1.

No anti-analysis in the runtime: no VM detection strings, no debug checks, no sandbox gates. IsDebuggerPresent is imported but that is standard KERNEL32 usage. The script-side may contain anti-analysis logic, but it is not recoverable statically.

No packing: Not UPX-packed. The .text section entropy (6.68) is consistent with compiled C/C++ code, not compression. ^[pefile.txt:92]

Deploy / ATT&CK

Because the threat logic lives in the encrypted AutoIt script, all ATT&CK mappings are inferred from the runtime import surface and known cluster behaviors. No dynamic execution was performed (CAPE skipped — no Windows guest). ^[dynamic-analysis.md]

Filename masquerade: Approved_686777-707987-098879896886.exe — procurement/approval-themed social-engineering lure with three numeric tracking codes (686777, 707987, 098879896886). The triple-dash format is common in the cluster (e.g., PAYMENT_INVOICE_RFQ_NEA062E23.exe, PO-22012025-RFQ.exe). This suggests the builder generates filenames from a template with randomized numeric segments.

No C2 infrastructure recovered: No hardcoded IPs, domains, URLs, or SMTP credentials in plaintext. The script payload is encrypted and would need decompilation (e.g., with MyAut2Exe or Exe2Aut) to recover C2 indicators.

No payload filenames recovered: Unlike many siblings that drop named companions to %TEMP% (e.g., ambiparous, Esher, myriopodous, Hegeleos), this sample yields no plaintext payload names. This could indicate a different script obfuscation level or a simpler payload delivery mechanism (in-memory only).

Decompiled Behavior

Ghidra/radare2 decompilation of the entry point (entry0 at 0x00425f74) reveals a standard MSVC C runtime initialization sequence: ^[r2:entry0]

1. Set up SEH (__security_init_cookie equivalent)
2. Validate PE headers (MZ signature check, PE signature check, machine type i386 check)
3. Initialize C runtime (__crtInitialize)
4. Resolve GetCommandLineW, GetModuleFileNameW
5. Call main() at 0x00403a0f
6. On return, call atexit destructors and ExitProcess

The main() function is the AutoIt interpreter entry point. Without decompiling the encrypted script bytecode, the actual threat logic is opaque. Radare2 found 2,706 functions in the .text section, the vast majority belonging to the AutoIt runtime, PCRE engine, and C standard library. ^[r2:fcn count]

No meaningful decompiled behavioral sections can be derived from the native code alone. The binary is a carrier — the payload is the script.

C2 Infrastructure

None recoverable statically. The encrypted SCRIPT resource prevents string extraction. Known cluster behaviors suggest HTTP/HTTPS or raw TCP C2 via WININET/WSOCK32, but no IOCs are available for this specific sample.

Interesting Tidbits

• First genuine Nov 2024 timestamp: Previous siblings peak at Oct 2024 (accd2ccd, ded287fe) or use fabricated Jan 2012 stamps on overlay-script variants. This sample confirms the cluster was active through Nov 2024. ^[rabin2-info.txt]
• MSVC 11.0 linker: Most siblings use MSVC 12.0 (VS 2013), 14.0 (VS 2015), or 14.16 (VS 2017). This is the first observed with VS 2012 linker 11.0. The AutoItSC runtime binary itself may have been built with different MSVC versions across releases. ^[exiftool.json]
• Empty VS_VERSIONINFO: Consistent with cluster — 40+ siblings have empty or near-empty version blocks. ^[pefile.txt:229]
• British English LangID (080904B0): Matches siblings 2d720f57, 3f3540e1, and f618a861. The builder may default to this locale. ^[exiftool.json]
• 11-icon suite: Richer than the cluster median (typically 4 icons). Suggests the builder has an icon-selection feature. ^[pefile.txt:965]
• No UPX packing: Unlike transport variants (6cc26f7c, 68e48a8c, 498f7bf3, c310cb2e), this is a plain PE32. ^[file.txt]
• Script in .rsrc: Most siblings store the script in .rsrc RT_RCDATA (this sample included). A minority use file overlay (ff84806a, e5647a2d, d990bd1b6, a8beee89, 941a189b, 7768873f, f346b7e9). ^[pefile.txt:956]

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 (or latest v3.3.16.1), AutoItSC single-file compiler (Aut2Exe.exe), Visual Studio 2012 (MSVC 11.0) optional (the runtime is precompiled).

Steps:

1. Install AutoIt v3.3.8.1 from https://www.autoitscript.com/site/autoit/downloads/
2. Write an AutoIt script that uses InetRead() or TCPConnect() to fetch a payload, FileWrite() to stage it to %TEMP%, and ShellExecute() or DllCallAddress() to execute it.
3. Compile with Aut2Exe.exe → Output: single-file PE32 GUI executable.
4. Observe: AU3!EA06 header in RT_RCDATA SCRIPT resource, WSOCK32/WININET/KERNEL32/USER32/GDI32 import surface, PCRE runtime strings in .rdata.

Verification: Run capa <reproducer.exe> — should hit the "autoit file limitation" warning with identical import-surface fingerprint. Compare rabin2 -I output to this sample's rabin2-info.txt.

What you'll learn: How compiled AutoIt scripts appear in PE resources, why static analysis of the native code alone is insufficient, and how the runtime import surface creates a predictable fingerprint regardless of script payload.

Deployable Signatures

YARA Rule

rule autoitsc_singlefile_pe32_cluster {
    meta:
        description = "AutoItSC v3.3.8.1 single-file PE32 cluster fingerprint"
        author = "PacketPursuit"
        date = "2026-07-18"
        hash = "c6c17d403f4d42946bee192df3559fb09087f030ffcc7c41d73b9fee76eb547b"
        reference = "https://www.autoitscript.com"
    strings:
        $au3_header = { A3 48 4B BE }              // SCRIPT resource header prefix
        $au3_marker = "AU3!EA06"                    // Compiled script signature
        $autoit_str = "This is a third-party compiled AutoIt script."
        $pcre1 = "this version of PCRE is compiled without UTF support"
        $pcre2 = "recursive call could loop indefinitely"
        $pcre3 = "syntax error in subpattern name (missing terminator)"
        $kernel = "KERNEL32.dll" ascii wide
        $user32 = "USER32.dll" ascii wide
        $wsock = "WSOCK32.dll" ascii wide
        $wininet = "WININET.dll" ascii wide
        $oleaut = "OLEAUT32.dll" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        ($au3_marker or $autoit_str) and
        3 of ($pcre*) and
        4 of ($kernel, $user32, $wsock, $wininet, $oleaut)
}

Behavioral Hunt Query (KQL/Splunk)

# KQL (Microsoft Sentinel / Defender ATP)
DeviceFileEvents
| where FileName matches regex @"(?i)^(Approved|Invoice|Payment|Purchase|PO|RFQ|Quotation|Quote|Order|Contract|Shipment|Bank|Salary|GSTP|SPECIFICATION|DHL|HAWB|AUG_SOA|FDA|INQUIRY)_[\d\-_]+\.exe$"
| where FolderPath contains "\\Downloads\\" or FolderPath contains "\\Temp\\" or FolderPath contains "\\Desktop\\"
| join kind=inner (
    DeviceProcessEvents
    | where FileName =~ "Approved_*.exe" or FileName =~ "Invoice_*.exe" or FileName =~ "Purchase_*.exe"
    | where InitiatingProcessCommandLine contains "AU3!" or InitiatingProcessFileName in ("AutoIt3.exe", "AutoItSC.exe")
) on DeviceId, Timestamp
| summarize count() by DeviceId, FileName, SHA256, Account

# Splunk (Sysmon + Windows Security)
index=sysmon EventCode=1
| regex Image="(?i)^(Approved|Invoice|Payment|Purchase|PO|RFQ|Quotation|Quote|Order|Contract|Shipment|Bank|Salary)_[\d\-_]+\.exe$"
| eval autoit_indicator=if(match(CommandLine, "(?i)autoit|au3|script"), 1, 0)
| stats values(ParentImage) as parent_processes, values(CommandLine) as commands by Image, Computer, User
| where match(parent_processes, "(?i)explorer\.exe")

IOC List

Behavioral Fingerprint Statement

This binary is a compiled AutoIt v3 single-file PE32 executable. On launch, the AutoIt interpreter decrypts and executes a compiled script stored in the PE .rsrc section (RT_RCDATA type, resource name SCRIPT, header AU3!EA06). The native PE import table is dominated by the AutoIt runtime surface: WSOCK32 (raw sockets), WININET (HTTP/FTP), KERNEL32 (process/file/registry APIs), USER32/GDI32 (screen/clipboard/keyboard), ADVAPI32 (registry/token manipulation), and OLEAUT32/ole32 (COM automation). The binary does not exhibit VM detection, debug checks, or packer signatures. Threat behavior (C2 addresses, payload download URLs, persistence commands, process injection) is contained in the encrypted script bytecode and is not recoverable via static string extraction.

Detection Signatures

References

• unclassified-autoit-compiled — cluster entity page (fifty-one confirmed siblings)
• autoit-compiled-script-dropper — concept page for AutoIt deployment patterns
• MalwareBazaar artifact: 895f0f51-4877-4c17-9f5b-b62c24e8ee0b ^[triage.json]
• AutoIt v3 documentation: https://www.autoitscript.com/site/autoit/downloads/

Provenance

• file.txt — file command (PE32 executable, 5 sections)
• exiftool.json — ExifTool 12.76 (PE metadata, timestamp, linker version, LangID)
• pefile.txt — pefile Python library (DOS/NT headers, sections, imports, resources, version info)
• strings.txt — strings -n 6 (2,548 strings, including PCRE error messages and AutoIt signature)
• rabin2-info.txt — radare2 rabin2 -I (architecture, compiler, canary, timestamp)
• capa.txt — Mandiant capa v9 (AutoIt file limitation warning)
• binwalk.txt — binwalk v2.3.4 (PE header, CRC32 polynomial table at offset 0xBE370)
• yara.txt — YARA rules PE_File_Generic, Suspicious_Wininet_Imports
• dynamic-analysis.md — CAPE sandbox status: skipped (no Windows guest)
• Radare2 analysis: 2,706 functions, entry point entry0 at 0x00425f74, main at 0x00403a0f