unclassified-autoit-compiled: c7eabe28 — LPO procurement lure, 751 KB script in overlay

Executive Summary

AutoItSC v3.3.8.1 single-file PE32 (LPO_2024-00123765-00967645486.exe) with a logistics/procurement social-engineering lure. Script is stored in the file overlay (not .rsrc), breaking autoit-ripper and most static extractors that target RT_RCDATA. Standard AutoIt runtime import surface; no plaintext C2, payload filenames, or shellcode markers recovered. Static-only analysis. Fifty-second confirmed sibling in the unclassified-autoit-compiled cluster.

What It Is

This sample belongs to the unclassified-autoit-compiled cluster but is distinctive for its overlay script placement — the compiled AutoIt bytecode lives after the last PE section rather than inside .rsrc RT_RCDATA. Nine siblings share this trait (see cluster entity page). The filename follows the cluster pattern of numeric tracking-code lures (LPO_2024-00123765-00967645486.exe), here targeting logistics/procurement departments with a "Letter of Purchase Order" or similar abbreviation.

How It Works

The binary is the AutoIt v3.3.8.1 interpreter runtime fused with an encrypted/compiled script payload. On execution:

1. Runtime bootstrap: The AutoItSC PE entry point (0x165C1) initializes the interpreter heap, loads the embedded PCRE regex engine, and locates the script payload.
2. Script location: Unlike the majority of cluster siblings that store the script in .rsrc RT_RCDATA ID=SCRIPT, this sample stores it in the file overlay immediately after the .rsrc section ends at raw offset 0x99200.
3. Decryption/execution: The runtime reads the overlay, verifies the AU3!EA06 magic, decrypts/decompresses the bytecode, and begins interpretation. The script logic itself is opaque without decompilation.
4. Import surface available to the script: The full AutoIt runtime import table gives the interpreted script access to WinInet (HTTP/FTP), WinSock (TCP/UDP), ADVAPI32 (registry, token manipulation, services), GDI32 (screenshots), PSAPI (process enumeration), and USERENV/MPR (profile/network drive abuse).

No evidence of UPX packing (unlike siblings 498f7bf3, 68e48a8c, c310cb2e, 6cc26f7c). The binary is plain PE32 with four sections (no .reloc).

Decompiled Behavior

Ghidra was not run on this sample. The AutoItSC runtime is a large C++ binary (~526 KB .text) with heavy C++ name mangling and PCRE regex bloat; static decompilation adds limited value over import-table analysis for this cluster. The threat logic lives in the encrypted overlay script, not in the native entry point. If decompilation is required for a specific function, the sample can be re-opened in radare2.

C2 Infrastructure

No C2 indicators recovered statically. The overlay script is encrypted with no plaintext URLs, IPs, domains, SMTP credentials, or Telegram bot tokens. The WinInet/WinSock imports confirm network capability, but the specific endpoints are runtime-resolved inside the script.

Interesting Tidbits

• Overlay placement evades autoit-ripper: Tools that scan .rsrc RT_RCDATA for AU3!EA06 will miss this sample; the script is at raw offset 0x99200 in the overlay.
• LPO lure theme: The filename LPO_2024-00123765-00967645486.exe suggests a "Letter of Purchase Order" or "Logistics Purchase Order" masquerade, fitting the cluster's procurement-tracking-code pattern.
• Four-section PE: Missing .reloc section is consistent with VS 2010 linker output when /FIXED or IMAGE_FILE_RELOCS_STRIPPED is used. ^[pefile.txt:39]
• British English LangID: 080904B0 (English, UK) in VS_VERSIONINFO — same as many cluster siblings, suggesting a common builder environment or geographic targeting bias.
• No PUP/PUA masquerade: Unlike siblings that masquerade as Adobe PDF (f51bc678) or DHL tracking (f618a861), this sample has no brand icons in .rsrc — just standard AutoIt runtime string tables.
• Standard import surface: No novel DLLs beyond the typical AutoItSC set. No ICMP.DLL (unlike ff84806a, e5647a2d).

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 + SciTE4AutoIt3 on Windows 7/10 x86.

Steps:

1. Install AutoIt v3.3.8.1 from https://www.autoitscript.com/site/autoit/downloads/ (archive).
2. Write a trivial test script (test.au3) using InetRead, FileWrite, RegWrite, and DllCall("kernel32.dll", ...).
3. Compile with Tools → Compile Script (x86).
4. Observe the resulting PE32. Check pefile.py or rabin2 -I for:
   • compiled Sun Jan 29 21:32:28 2012 (fabricated timestamp from older AutoItSC builds)
   • AutoIt v3 Script: 3, 3, 8, 1 in VS_VERSIONINFO
   • Script in .rsrc RT_RCDATA (default) or overlay (if using custom builder/modified stub)
5. Run capa <sample.exe> — expect the autoit file limitation warning. ^[capa.txt]

What you'll learn: How AutoItSC fuses interpreter + script, why the import table is identical across dozens of unrelated malware families, and how overlay placement defeats naive .rsrc scrapers.

Deployable Signatures

YARA rule

rule AutoItSC_SingleFile_PE32_LPO_Overlay
{
    meta:
        description = "AutoItSC v3.3.8.1 single-file PE32 with overlay script placement and LPO-style filename"
        author = "pp-hermes"
        date = "2026-07-18"
        sha256 = "c7eabe2849c6983691b237c2e95c429676d44b74f5ffcf1de1b7f1b306320136"
        family = "unclassified-autoit-compiled"
    strings:
        $au3_magic = "AU3!EA06" ascii
        $compiled = "CompiledScript: AutoIt v3 Script: 3, 3, 8, 1" ascii wide
        $lpo1 = "LPO_20" ascii wide nocase
        $lpo2 = "_009" ascii wide
        $wininet = "WININET.dll" ascii
        $wsock32 = "WSOCK32.dll" ascii
        $pcre_err1 = "numbers out of order in {} quantifier" ascii
        $pcre_err2 = "PCRE does not support \\L, \\l, \\N{name}, \\U, or \\u" ascii
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 4 and
        $au3_magic and
        $compiled and
        $wininet and
        $wsock32 and
        any of ($pcre_err*) and
        filesize > 1MB and filesize < 2MB
}

Behavioral hunt query (Sigma)

title: AutoItSC Single-File PE32 Execution with LPO Filename
status: experimental
description: Detects execution of AutoIt-compiled PE32 with logistics/purchase-order themed filenames
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '.exe'
        - Image|contains:
            - 'LPO_20'
            - 'PURCHASE_ORDER'
            - 'RFQ_'
            - 'INVOICE'
            - 'QUOTE#'
    condition: selection
falsepositives:
    - Legitimate procurement software
level: medium

IOC list

Behavioral fingerprint

This binary is a 1.31 MB PE32 x86 GUI executable compiled with AutoItSC v3.3.8.1. It contains four PE sections (no .reloc) and stores its compiled script bytecode in the file overlay at offset 0x99200 rather than in .rsrc. The import table includes WinInet, WinSock, ADVAPI32, PSAPI, and GDI32, giving the embedded script full network, registry, process, and screenshot capabilities. No plaintext C2 is present; all endpoints are runtime-resolved by the interpreted script. The filename follows a numeric tracking-code pattern (LPO_2024-00123765-00967645486.exe) consistent with procurement-themed social engineering.

Detection Signatures

References

• unclassified-autoit-compiled — cluster entity page (52 siblings)
• autoit-compiled-script-dropper — concept page for AutoIt delivery patterns
• MalwareBazaar: https://bazaar.abuse.ch/sample/c7eabe2849c6983691b237c2e95c429676d44b74f5ffcf1de1b7f1b306320136/

Provenance

Analysis based on:

• file v5.44
• exiftool v12.76
• pefile (Python) — full PE header/resource dump
• rabin2 -I (radare2)
• strings -n 8
• capa v9 — flagged AutoIt limitation
• floss — failed due to CLI argument error
• Manual xxd and python3 entropy inspection of overlay

No CAPE dynamic analysis available (no Windows guest at time of detonation).