unclassified-autoit-compiled: c9c81f5b — 227 KB SCRIPT quotation-lure, Jul 2024 MSVC 14.16

Executive Summary

AutoIt v3 single-file compiler (AutoItSC) PE32 with a 227 KB encrypted compiled script stored in .rsrc (RT_RCDATA). Masquerades as a business quotation (QUOTATION_-_E401723.exe). MSVC 14.16 runtime, Jul 2024 build, empty VS_VERSIONINFO, no Authenticode. Sixteenth confirmed sibling in the unclassified-autoit-compiled cluster. No CAPE detonation available (no Windows guest). Static-only characterization.

What It Is

Cluster ascription: AU3!EA06 marker in RT_RCDATA resource, full PCRE regex error-message table, .text$lp00AutoItSC linker section, and identical import surface to fifteen prior siblings. ^[strings.txt:761–790] ^[unclassified-autoit-compiled.md]

How It Works

Payload Storage

The compiled AutoIt script is stored as a RT_RCDATA resource (type 10) at offset 0xFF000 (1044576), size 232,728 bytes (227 KB). ^[resource-dump] The resource begins with the encrypted header a3484bbe... and contains the AU3!EA06 marker internally, confirming AutoIt v3.3.8.1+ compiled script format. ^[strings.txt:761] Without a decompiler (MyAut2Exe, Exe2Aut), the script logic is opaque.

Runtime Surface

The AutoItSC interpreter runtime imports the full standard Win32 surface observed across all siblings:

• Network: WinInet (HTTP/HTTPS/FTP), WinSock (raw TCP/UDP/ICMP), IPHLPAPI (ICMP echo reconnaissance) ^[pefile.txt:373–408]
• Registry / Token: ADVAPI32 (RegCreateKeyExW, RegSetValueExW, AdjustTokenPrivileges, CreateProcessAsUserW, OpenProcessToken, LookupPrivilegeValueW) ^[pefile.txt:421–1247]
• Process / Memory: KERNEL32 (CreateProcessW, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateToolhelp32Snapshot, Process32FirstW/NextW) ^[pefile.txt:441–1001]
• UI / Collection: USER32 (GetAsyncKeyState, SendInput, keybd_event, GetClipboardData, SetClipboardData, GetWindowTextW, EnumWindows, FindWindowW), GDI32 (GetDIBits, StretchBlt, BitBlt) ^[pefile.txt:1015–1210]
• Shell / File: SHELL32 (ShellExecuteW, SHGetFolderPathW, SHFileOperationW), MPR (WNetAddConnection2W, WNetUseConnectionW) ^[pefile.txt:1248–1263]

This is the identical import footprint to siblings 2c6133ca, f618a861, and c80ef443. ^[unclassified-autoit-compiled.md]

Per-Sample Deltas

The 227 KB script size is mid-range for the cluster, suggesting a moderately complex payload (not a minimal stub, not the 932 KB maximal sibling).

Decompiled Behavior

Ghidra / radare2 decompilation of the AutoItSC interpreter runtime is not productive — the threat logic lives in the encrypted compiled script. Capa explicitly aborts meaningful analysis with the autoit file limitation warning. ^[capa.txt] Without script decompilation, runtime behavior must be inferred from the import surface and known AutoIt malware patterns (see unclassified-autoit-compiled cluster page for historical TTPs).

C2 Infrastructure

No hardcoded C2 strings recovered from the compiled script resource (encrypted). No CAPE detonation executed (no Windows guest available). ^[dynamic-analysis.md]

Historical siblings in this cluster show WinInet/WinSock C2 patterns. Static inference only:

• C2 protocol: Likely HTTP/HTTPS via InternetOpenW → InternetConnectW → HttpOpenRequestW → HttpSendRequestW, or raw TCP via socket/connect/send/recv. ^[pefile.txt:373–408]
• Exfil / staging: FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile present — possible FTP fallback or payload download. ^[pefile.txt:373–408]

No domains, IPs, URLs, mutexes, or named pipes observed statically.

Interesting Tidbits

• Quotation lure: The filename QUOTATION_-_E401723.exe follows the same pattern as procurement-themed siblings (PO_#86637.exe, INQUIRY_2024-SP0006-B(01)_INQ24-012207.exe), suggesting a single actor or kit targeting B2B supply-chain email fraud. ^[triage.json]
• Icon masquerade: Binwalk detects a 256×256 PNG icon at offset 0xCFD50, likely an Adobe Acrobat or document-themed icon to reinforce the lure. ^[binwalk.txt]
• PCRE regex library: Full Perl Compatible Regular Expressions error strings and Unicode script-name table present in .rdata, confirming the AutoIt v3 runtime includes PCRE for script-side pattern matching. ^[strings.txt:565–770]
• No anti-debug: IsDebuggerPresent is imported (standard CRT/runtime), but no CheckRemoteDebuggerPresent, NtQueryInformationProcess, or timing-loop evasion observed. No VM detection imports. The script-side may implement sandbox gates, but this is opaque statically.
• Empty version info: VS_VERSIONINFO exists but all fields are zeroed — no fake vendor name, unlike some siblings that masquerade as legitimate software. ^[pefile.txt:229–272]

How To Mess With It (Homelab Replication)

To build an AutoItSC single-file PE from a benign script for defensive research:

1. Toolchain: Download AutoIt v3.3.16.1 from autoitscript.com (official site). Install SciTE4AutoIt3.
2. Script: Write a trivial .au3 script:

   #include <InetConstants.au3>
   Local $sURL = "http://example.com/test"
   Local $hDownload = InetGet($sURL, @TempDir & "\test.dat", $INET_FORCERELOAD)
   

3. Compile: Right-click → Compile Script (x86) → produces script.exe.
4. Verify: Run capa script.exe — should hit the same autoit file limitation warning and show Suspicious_Wininet_Imports in YARA.
5. What you learn: The generated PE will have the same 5-section layout, empty VS_VERSIONINFO, and near-identical import surface to this sample. The .rsrc section will contain a RT_RCDATA resource with the AU3!EA06 header.

To extract the compiled script from any AutoItSC PE:

python3 -c "
import pefile, sys
pe = pefile.PE(sys.argv[1])
for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
    if entry.id == 10:  # RT_RCDATA
        for e in entry.directory.entries:
            for lang in e.directory.entries:
                data = lang.data.struct
                print(f'RT_RCDATA offset={data.OffsetToData} size={data.Size}')
                with open('script.rcdata', 'wb') as f:
                    f.write(pe.get_data(data.OffsetToData, data.Size))
" sample.exe

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PE32_2024 : malware_family {
    meta:
        description = "AutoIt v3 single-file compiler PE32 with encrypted script in .rsrc"
        author = "PacketPursuit SOC"
        date = "2026-06-24"
        family = "unclassified-autoit-compiled"
        reference = "/intel/analyses/c9c81f5be1bd1b496eb08f067889383ebe1c90b7cf11be791d197e69160a3216.html"
    strings:
        $au3_marker = "AU3!EA06" ascii wide
        $autoit_sc = ".text$lp00AutoItSC" ascii
        $pcre_error1 = "numbers out of order in {} quantifier" ascii
        $pcre_error2 = "missing terminating ] for character class" ascii
        $pcre_error3 = "unrecognized character follows \\" ascii
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x4550 and
        uint16(uint32(0x3C)+0x5C) == 0x10B and  // PE32
        ($au3_marker or $autoit_sc) and
        2 of ($pcre_error*)
}

Behavioral Fingerprint Statement

This binary is a PE32 x86 GUI executable with 5 sections (.text, .rdata, .data, .rsrc, .reloc), compiled with MSVC 14.x linker, empty VS_VERSIONINFO, no Authenticode signature, and no packing. It imports the full WinInet/WinSock/ADVAPI32/GDI32/USER32/SHELL32 surface typical of the AutoIt v3 interpreter runtime. The .rsrc section contains a 200–1000 KB RT_RCDATA resource beginning with high-entropy bytes and containing the ASCII string AU3!EA06. The .rdata section includes a full PCRE regex error-message table. No hardcoded C2 strings are visible; the script logic is encrypted. Capa produces an autoit file limitation warning and extracts no meaningful capabilities. These binaries are typically distributed via email with invoice, quotation, shipping, or procurement-themed filenames.

IOC List

Detection Signatures (Capa → ATT&CK)

Capa aborts with the AutoIt limitation warning and produces no capability map. ^[capa.txt] Static inference from imports:

All TTPs are statically inferred from the AutoIt runtime import surface. No CAPE behavioral confirmation.

References

• unclassified-autoit-compiled — Cluster entity page with 15 prior siblings and shared TTPs
• autoit-compiled-script-dropper — Concept page for AutoIt malware deployment patterns
• asgardprotector — Related IExpress SFX family that embeds AutoIt3 payloads
• MalwareBazaar: https://bazaar.abuse.ch/sample/c9c81f5be1bd1b496eb08f067889383ebe1c90b7cf11be791d197e69160a3216/
• Artifact ID: 73089880-5766-4a20-9ca6-863776bb6065 ^[triage.json]

Provenance

Analysis built from:

• file.txt (file type), exiftool.json (metadata), pefile.txt (PE headers, imports, sections, version info), strings.txt (ASCII strings), rabin2-info.txt (radare2 binary summary), capa.txt (capa 7.0.1 limitation warning), binwalk.txt (embedded artefacts), yara.txt (triage YARA matches), triage.json (triage record), dynamic-analysis.md (CAPE skipped — no Windows guest). Resource extraction performed via Python pefile library. No Ghidra decompilation performed (interpreter runtime not meaningful to decompile; script encrypted).