unclassified-autoit-compiled: cbadab4db7d5 — RFQ-themed single-file PE32, May 2024 build

Build / RE

Toolchain: AutoIt v3 single-file compiler (AutoItSC) producing a standalone PE32 x86 GUI executable. Runtime version v3.3.8.1 identified by AU3!P/I and AU3!EA06 markers in the binary overlay and string table.^[strings.txt:1295] ^[strings.txt:1377] ^[strings.txt:1950]

Linker: Microsoft linker 14.16 (Visual Studio 2017) — consistent with the cluster's dominant toolchain. PE timestamp 2024-05-17 12:35:22 UTC is genuine and predates most siblings (cluster activity typically peaks Jul–Sep 2024).^[pefile.txt]

Script storage: Compiled AutoIt bytecode resides in .rsrc section, type RT_RCDATA (10), name SCRIPT. Raw offset 0xC9DB8, size 327,551 bytes, entropy 8.00 — perfectly encrypted/compiled, no static decompilation possible without the runtime key.^[ghidra:resource-extraction] The AU3!EA06 header is present at raw offset 0xC9DC8, confirming standard AutoItSC v3 encryption format.^[strings.txt:1950]

Packing: None. Non-UPX, plain PE32 with five standard sections (.text, .rdata, .data, .rsrc, .reloc).

Imports: Full AutoItSC runtime surface — WSOCK32, WININET, KERNEL32, USER32, GDI32, ADVAPI32, SHELL32, ole32, OLEAUT32, MPR, IPHLPAPI, PSAPI, USERENV, UxTheme, VERSION, WINMM, COMCTL32, COMDLG32, NTDLL.^[pefile.txt] This is the canonical import fingerprint for the cluster.

Version info: Empty VS_VERSIONINFO block (a cluster hallmark — only sibling 2d720f57 has non-empty metadata).^[pefile.txt]

Icons: Four icon groups, eleven individual icon resources in .rsrc.^[pefile.txt]

Anti-analysis: None observed in the PE wrapper itself. The compiled script provides natural static obfuscation. capa issues its standard AutoIt limitation warning and exits.^[capa.txt] floss failed to execute (command-line parse error), yielding no decoded strings.^[floss.txt]

Code quality: Commercial-grade AutoItSC runtime; no debug symbols, no PDB, no RTTI.

Deploy / ATT&CK

Dynamic analysis: Not available — CAPE skipped (no Windows guest).^[dynamic-analysis.md] All TTPs are inferred from the import surface and known AutoIt malware patterns.

• T1059.005 — Command and Scripting Interpreter: AutoIt (compiled script execution inside the AutoIt interpreter runtime).^[pefile.txt]
• T1071.001 — Web Protocols: WinInet/WinSock imports enable HTTP/FTP/raw-socket C2.^[pefile.txt]
• T1095 — Non-Application Layer Protocol: WSOCK32 presence allows raw TCP/UDP communication.^[pefile.txt]
• T1547.001 — Registry Run Keys: ADVAPI32 imports enable RegSetValueExW persistence (standard AutoIt malware pattern).^[pefile.txt]
• T1053.005 — Scheduled Task: SHELL32/ole32 surface enables COM-based task scheduling.^[pefile.txt]
• T1083 — File and Directory Discovery: standard AutoIt FileFindFirstFile / DirGetSize primitives.^[pefile.txt]
• T1057 — Process Discovery: PSAPI imports for process enumeration.^[pefile.txt]
• T1012 — Query Registry: ADVAPI32 RegQueryValueExW.^[pefile.txt]
• T1113 — Screen Capture: GDI32 BitBlt / CreateCompatibleDC.^[pefile.txt]
• T1115 — Clipboard Data: USER32 GetClipboardData.^[pefile.txt]
• T1056.001 — Keylogging: USER32 GetAsyncKeyState.^[pefile.txt]

C2 / Exfil: No plaintext C2 strings, payload filenames, shellcode indicators, or SMTP credentials recovered statically. The 8.00-entropy SCRIPT resource blocks all static inference of network behaviour. This is typical for the cluster — only siblings with decompilable script fragments or dropped payload artefacts reveal C2.^[strings.txt]

Attribution: Fifty-third confirmed sibling in the unclassified-autoit-compiled cluster. Build fingerprint (AutoItSC v3.3.8.1, MSVC 14.16 linker, .rsrc RT_RCDATA placement, empty VS_VERSIONINFO, full PCRE regex runtime, standard import surface) is identical to siblings 7c706df3, f2be9e06, f527ce01, and 2d720f57. The May 2024 timestamp extends cluster activity earlier than the previously observed Jul–Sep 2024 peak.^[entities/unclassified-autoit-compiled.md]

Masquerade: Filename suggests a Request for Quotation (RFQ) procurement lure — consistent with the cluster's heavy targeting of finance/procurement departments via business-document social engineering.^[strings.txt]