unclassified-autoit-compiled: c80ef443 — UPX-packed RFQ lure, 220 KB SCRIPT resource

Executive Summary

Fifteenth confirmed sibling in the unclassified-autoit-compiled AutoItSC cluster: a UPX-packed PE32 masquerading as an industrial Request-for-Quotation ((RFQ-11345).exe). MSVC 2017 runtime, compiled Jul 2024, unpacks to a 1.1 MB single-file PE32 with a 220 KB encrypted SCRIPT resource in .rsrc. Full PCRE regex runtime and standard AutoItSC WinInet/WinSock/ADVAPI32 import surface. Static-only; CAPE skipped due to no Windows guest.

What It Is

The packed form shows classic UPX markers (UPX0, UPX1, zero-raw-size UPX0) ^[pefile.txt]. UPX 4.2.2 unpacks cleanly to a 1.1 MB PE32 with standard 5-section layout (.text, .rdata, .data, .rsrc, .reloc).

How It Works

Packing / Delivery

UPX compression reduces the binary from ~1.1 MB to 614 KB. The packed PE retains the standard UPX stub import table (only LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess from KERNEL32.DLL) ^[pefile.txt]. All other imports are reconstructed by the UPX decompressor at runtime.

AutoItSC Runtime

The unpacked binary is a direct output of the AutoIt v3 single-file compiler (AutoItSC). Evidence:

• Section marker .text$lp00AutoItSC in unpacked .text ^[strings.txt]
• Banner string: This is a third-party compiled AutoIt script. ^[strings.txt]
• 220 396-byte encrypted compiled script stored as RT_RCDATA resource ID 10 at offset 0x903096 (LANG 0x0000) ^[pefile.txt:430-501]

Import Surface (unpacked)

Standard AutoItSC surface, confirming network, registry, process, and UI capabilities:

• WinInet: InternetOpenW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, InternetReadFile, InternetQueryDataAvailable, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetCloseHandle, InternetQueryOptionW ^[pefile.txt]
• WinSock: WSOCK32.dll.connect (by ordinal) ^[pefile.txt]
• ADVAPI32: GetAce, RegDeleteKeyExW ^[pefile.txt] + runtime-resolved registry APIs
• SHELL32: DragFinish ^[pefile.txt]
• GDI32: LineTo, SetPixel, GetPixel ^[pefile.txt]
• USER32: GetDC, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, DrawFrameControl, GetWindowDC, GetActiveWindow, RedrawWindow, GetWindowTextLengthW, CallWindowProcW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetForegroundWindow, FindWindowW, LockWindowUpdate ^[pefile.txt]
• Process / memory: CreateProcessW, OpenProcess, VirtualAllocEx, VirtualFreeEx, WriteProcessMemory, ReadProcessMemory, TerminateProcess, Process32FirstW, Process32NextW, GetExitCodeProcess, GetCurrentProcessId, GetProcessId, GetProcessIoCounters ^[strings.txt]
• ICMP reconnaissance: IcmpSendEcho (from IPHLPAPI.DLL) ^[pefile.txt]
• PCRE regex: Full error-message table embedded (unmatched parentheses, reference to non-existent subpattern, PCRE does not support \L, etc.) ^[strings.txt]

Version Info / Masquerade

Empty VS_VERSIONINFO: all file/product version fields are 0.0.0.0, no company name, no copyright, no description ^[pefile.txt:195-239]. This is typical of the cluster — the threat actor relies on the filename lure rather than version-resource masquerade.

Resource Layout

The .rsrc section (247 808 bytes raw) contains:

• RT_ICON (ID 3): 11 icons ranging from 16×16 to 48×48, all 8-bit and 32-bit colour depths ^[pefile.txt]
• RT_GROUP_ICON (ID 14): 4 icon groups
• RT_VERSION (ID 16): 220-byte VS_VERSIONINFO (empty)
• RT_RCDATA (ID 10): 220 396-byte encrypted compiled AutoIt script — the payload core
• RT_STRING / RT_MANIFEST: AutoIt runtime error strings and UAC manifest

Decompiled Behavior

Static analysis only (CAPE skipped — no Windows guest available ^[dynamic-analysis.md]). No Ghidra decompilation attempted; the threat logic lives in the encrypted AutoIt bytecode, not in the C++ runtime. The runtime is the stock AutoItSC v3 interpreter (MSVC 2017 build). Behaviour must be inferred from:

1. The import table (network, registry, process, GDI APIs)
2. The presence of PCRE regex runtime (script-side pattern matching / data harvesting)
3. Known AutoIt malware patterns (see unclassified-autoit-compiled entity page)

Notable runtime functions in the unpacked .text include the standard AutoIt interpreter loop, string-table management, and COM dispatch stubs. No anti-debug or VM detection in the runtime itself — evasion is provided by the compiled-script encryption.

C2 Infrastructure

No hardcoded C2 strings recovered. The AutoIt script (220 KB encrypted resource) is the likely source of any C2 configuration. Static extraction of the script body is not possible without the AutoIt decompiler key.

Interesting Tidbits

• Fifteenth confirmed sibling in the unclassified-autoit-compiled cluster. See unclassified-autoit-compiled for the full cluster analysis.
• First UPX-packed sibling with an industrial RFQ lure in this cluster. Prior UPX-packed sibling (6cc26f7c) used a logistics shipping lure; fb495efe was a packed variant of an invoice lure. The RFQ theme expands the social-engineering target surface to industrial procurement/B2B pipelines.
• Compile date (Jul 2024) places this in the same active campaign window as siblings 2c6133ca (Jul 2024), f0059bee (Aug 2024), f2be9e06 (Sep 2024), and f51bc678 (Jul 2024).
• Empty VS_VERSIONINFO is consistent with the cluster — the actor does not bother with version-resource masquerade, relying entirely on the filename.
• PCRE regex runtime present, suggesting script-side data harvesting (email addresses, credentials, cryptocurrency wallets, or file-name pattern matching).

How To Mess With It (Homelab Replication)

1. Download AutoIt v3.3.16.1 from https://www.autoitscript.com/site/autoit/downloads/
2. Write a simple AutoIt script (e.g., MsgBox(0, "Test", "Hello"))
3. Compile with Tools → Compile Script (x86) → Options → "Add file to resources"
4. Pack with UPX: upx --best your_script.exe
5. Verify: strings your_script.exe | grep -i autoit should show This is a third-party compiled AutoIt script.
6. Inspect resources with Resource Hacker or pedump.py — confirm RT_RCDATA type 10 with SCRIPT name
7. Capa will flag compiled AutoIt script and the WinInet/WinSock import surface

Deployable Signatures

YARA rule

rule autoitsc_upx_packed_rfq_lure {
    meta:
        description = "AutoItSC single-file PE32 with UPX packing and industrial RFQ filename lure"
        author = "PacketPursuit"
        date = "2026-06-23"
        sha256 = "c80ef443e73c89b4eae3b65bef48359ce2e63e92356e657fbfd396da1347951e"
    strings:
        $upx0 = { 55 50 58 30 00 00 00 00 }
        $upx1 = { 55 50 58 31 00 00 00 00 }
        $autoit_banner = "This is a third-party compiled AutoIt script." ascii wide
        $autoit_section = ".text$lp00AutoItSC" ascii
        $pcre1 = "this version of PCRE is compiled without UTF support" ascii
        $pcre2 = "PCRE does not support \\L, \\l, \\N{name}, \\U, or \\u" ascii
        $rfq1 = /RFQ[-_ ]?\d{3,6}/i ascii wide
        $rfq2 = "Request for Quotation" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and
        ($upx0 at (pe.sections[0].raw_data_offset - 0x400 + 0x218)) and
        ($upx1 at (pe.sections[1].raw_data_offset - 0x400 + 0x240)) and
        any of ($autoit_*) and
        any of ($pcre_*) and
        filesize < 700KB
}

Sigma rule

title: AutoItSC UPX Packed RFQ Lure Execution
description: Detects execution of UPX-packed AutoItSC binaries with RFQ-themed filenames
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        - Image|endswith:
            - '\\(RFQ-*.exe'
            - '\\RFQ*.exe'
            - '\\Request_for_Quotation*.exe'
        - CommandLine|contains:
            - 'RFQ-'
            - 'Request for Quotation'
    condition: selection
falsepositives:
    - Legitimate procurement software using RFQ naming (unlikely with .exe extension)
level: high

IOC list

Behavioral fingerprint

This binary is a UPX-packed AutoIt v3 single-file compiler output. On execution, the UPX stub decompresses the runtime into memory, then the AutoIt interpreter decrypts and executes a 220 KB compiled script stored as an RT_RCDATA resource. The runtime imports WinInet (HTTP/FTP), WinSock (TCP), ADVAPI32 (registry), GDI32 (screenshots), and USER32 (window/UI manipulation). Network C2 is not observable statically — it is configured inside the encrypted script body. The binary exhibits no anti-debug or VM checks in the runtime itself.

Detection Signatures

• capa: compiled AutoIt script (heuristic), packed (UPX) ^[capa.txt]
• YARA: PE_File_Generic, Likely_Packer_UPX ^[yara.txt]
• diec (if run): AutoIt v3.x compiler signature in .text

References

• unclassified-autoit-compiled — cluster entity page with full TTPs and sibling catalogue
• autoit-compiled-script-dropper — concept page covering single-file and two-file AutoIt deployment
• MalwareBazaar: c80ef443e73c89b4eae3b65bef48359ce2e63e92356e657fbfd396da1347951e (labelled exe / malware-bazaar)
• AutoIt v3 single-file compiler: https://www.autoitscript.com/autoit3/docs/intro/compiler.htm

Provenance

• file.txt — file(1) output, unpacked with upx -d
• pefile.txt — pefile Python library header/resource/import parsing
• exiftool.json — ExifTool 12.76 PE metadata
• rabin2-info.txt — radare2 rabin2 -I binary summary
• strings.txt — GNU strings -n 6 on packed binary
• capa.txt — Mandiant capa v8.0.1 static analysis (packed sample)
• yara.txt — custom YARA rules (PE_File_Generic, Likely_Packer_UPX)
• dynamic-analysis.md — CAPE sandbox status (skipped, no Windows guest)
• Manual UPX unpacking with UPX 4.2.2, strings extraction on unpacked binary, pefile resource enumeration