unclassified-autoit-compiled: cca7d56d — banking-details lure, 183 KB SCRIPT resource

Executive Summary

PE32 AutoItSC single-file executable compiled Sep 2024 with a banking-details filename lure (BANK_DETAILS_RO83728274746272627362.exe). Seventeenth confirmed sibling in the unclassified-autoit-compiled cluster. The compiled AutoIt script (183 KB) lives inside .rsrc as an RT_RCDATA named SCRIPT. Standard AutoIt runtime import surface covers HTTP/FTP C2, raw sockets, registry persistence, token impersonation, and process injection primitives. No C2 strings recovered statically; all threat logic is inside the encrypted compiled bytecode. Static-only analysis — no CAPE detonation.

What It Is

AutoItSC fingerprint:

• AU3!EA06 header fragments in strings ^[strings.txt:20], ^[strings.txt:1381], ^[strings.txt:1746]
• This is a third-party compiled AutoIt script. ^[strings.txt:782]
• Full PCRE regex runtime error-message table present ^[strings.txt:625–661]
• Capa identifies compiled with AutoIt and refuses further analysis ^[capa.txt:5]

SCRIPT resource:

• Type 10 (RT_RCDATA), Name SCRIPT ^[pefile.txt:1486–1497]
• Size: 0x2CFAC (~183 KB) at offset 0xD07B8 ^[pefile.txt:1513–1514]
• Standard AutoIt compiled-bytecat placement (not overlay)

Version info: Empty VS_VERSIONINFO — FileVersionMS/LS and ProductVersionMS/LS all zero, no StringFileInfo strings populated ^[pefile.txt:229–256]. This is consistent with the cluster fingerprint.

How It Works

At launch the AutoItSC runtime:

1. Loads its own PE resources, locates the SCRIPT RT_RCDATA blob in .rsrc
2. Decrypts/decompresses the compiled AutoIt bytecode (183 KB)
3. Executes the script inside the embedded interpreter

The actual malicious behavior is entirely inside the compiled script and not visible to static string extraction. What we can infer comes from the runtime import table the script will call into.

Network capability: Full WinInet surface (HTTP/FTP client) plus WinSock32 raw TCP/UDP socket API ^[pefile.txt:284–306], ^[pefile.txt:373–386]. Script can fetch payloads, beacon, or open reverse shells over either protocol.

Persistence: ADVAPI32 imports include RegSetValueExW, RegCreateKeyExW, RegOpenKeyExW ^[pefile.txt:838–862]. Standard AutoIt malware pattern is HKCU/HKLM \Software\Microsoft\Windows\CurrentVersion\Run.

Privilege escalation / token abuse: OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, LogonUserW ^[pefile.txt:848–859]. Script can escalate to SYSTEM or spawn processes under alternate credentials.

Process manipulation: CreateToolhelp32Snapshot, Process32FirstW, Process32NextW for enumeration; VirtualAllocEx, WriteProcessMemory, ReadProcessMemory for injection primitives ^[pefile.txt:476–478], ^[pefile.txt:464–468].

File system / staging: Full KERNEL32 file API including GetTempPathW, GetTempFileNameW, CreateDirectoryW, CopyFileExW, MoveFileW, DeleteFileW ^[pefile.txt:469–491]. Common AutoIt pattern: stage payloads to %TEMP% or %APPDATA%.

Screen capture / clipboard: GDI32 (BitBlt, CreateCompatibleBitmap, etc.) and USER32 (GetClipboardData, SetClipboardData) present ^[pefile.txt:783–816]. Combined with GetAsyncKeyState ^[pefile.txt:1000–1005] for keylogging.

UI masquerade: COMCTL32 ImageList and drag APIs, plus UxTheme IsThemeActive ^[pefile.txt:340–350], suggest the script may render fake UI windows or dialog boxes as part of social engineering.

Decompiled Behavior

Ghidra was queued for this sample but analysis was not complete at report time. The binary is a standard AutoItSC runtime — decompilation of the C++ runtime would reveal the interpreter loop and resource-loading stub, not the actual malicious logic. The meaningful code is inside the 183 KB compiled script resource. For reverse engineering the payload, extract the SCRIPT blob and run through MyAut2Exe or Exe2Aut to recover AutoIt source.

C2 Infrastructure

No C2 strings recovered statically. No URLs, domains, IP addresses, mutex names, or named pipes found in the PE strings ^[strings.txt]. All C2 configuration is expected to be inside the compiled AutoIt script. The runtime surface supports:

• HTTP/HTTPS via WinInet (InternetOpenW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW)
• FTP via WinInet (FtpOpenFileW)
• Raw TCP/UDP via WinSock32 (socket, connect, send, recv)

Interesting Tidbits

• Banking lure theme: Filename masquerades as a bank-details document with a long numeric suffix (RO83728274746272627362) — a new lure theme for this cluster, which previously favoured invoices, purchase orders, DHL airway bills, and procurement quotations. ^[triage.json:5]
• Smaller script size: At 183 KB this is one of the smaller SCRIPT payloads in the cluster (range 186 KB–932 KB). May indicate a stripped-down payload or a different builder config.
• No UPX packing: Unlike siblings c80ef443 and 6cc26f7c, this sample is plain PE32 (non-UPX). Matches the 2c6133ca, 1d0834e7, f618a861 plain variants.
• VS 2013 linker: MSVC 12.0 linker is older than the VS 2017–2019 (14.x) seen in most Jul–Sep 2024 siblings. Suggests the AutoItSC build environment may be a legacy install.
• Full PCRE runtime present: The embedded PCRE regex library (with its complete error-message table) is a cluster-wide trait. It enables the script to perform complex pattern matching — often used for harvesting credentials from browser data or parsing C2 responses.

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.16.1 (or latest 3.x) + SciTE4AutoIt3 on Windows 10/11.

Build recipe:

1. Write a minimal AutoIt script that uses InetRead() or HttpSetRequest() to fetch a remote payload, then FileWrite() to stage it in @TempDir, and RegWrite() to add a Run key.
2. Compile with AutoItSC: Aut2Exe.exe /in script.au3 /out test.exe /icon bank.ico
3. The output will be a single PE32 with the script embedded as RT_RCDATA named SCRIPT.

Verification:

• Run capa test.exe — should hit the same autoit file limitation warning ^[capa.txt].
• Run strings test.exe | grep -i autoit — should see This is a third-party compiled AutoIt script. and PCRE error messages.
• Inspect .rsrc with pefile.py or Resource Hacker — confirm SCRIPT resource exists.

What you'll learn: How compiled AutoIt scripts hide their logic inside PE resources, why static analysis of the outer binary is insufficient, and how the runtime import table becomes the primary static indicator.

Deployable Signatures

YARA rule

rule AutoItSC_Banking_Lure_Cluster
{
    meta:
        description = "AutoItSC single-file PE32 with banking lure filename pattern"
        author = "PacketPursuit"
        date = "2026-06-24"
        hash = "cca7d56dffd819b96dcc149a4cd08308aa40035b73930e409d83e6434932b68e"

    strings:
        $au3_header = { 41 55 33 21 45 41 30 36 }  // "AU3!EA06"
        $autoit_msg = "This is a third-party compiled AutoIt script."
        $pcre_err1 = "this version of PCRE is compiled without UTF support"
        $pcre_err2 = "support for \\P, \\p, and \\X has not been compiled"
        $bank_lure1 = /BANK_DETAILS_[A-Z0-9]{10,30}\.exe/i
        $bank_lure2 = /BANK_STATEMENT_[A-Z0-9]{10,30}\.exe/i
        $bank_lure3 = /PAYMENT_ADVICE_[A-Z0-9]{10,30}\.exe/i

    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 5 and
        pe.linker_version.major == 12 and
        pe.timestamp >= 1700000000 and
        $autoit_msg and
        ($pcre_err1 or $pcre_err2) and
        any of ($bank_lure*)
}

Behavioral hunt query (Sigma)

title: AutoItSC Banking Lure Execution
status: experimental
description: Detects execution of AutoItSC PE32 with banking lure filename pattern
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'BANK_DETAILS_'
            - 'BANK_STATEMENT_'
            - 'PAYMENT_ADVICE_'
        Image|endswith: '.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

IOC list

Behavioral fingerprint

This binary is a single-file AutoItSC PE32 x86 GUI executable with an empty VS_VERSIONINFO, Microsoft linker 12.0, and a compiled AutoIt script (~180–900 KB) stored as RT_RCDATA named SCRIPT in .rsrc. On execution it loads the script into the embedded interpreter and runs it. The script has access to the full WinInet HTTP/FTP client surface, WinSock32 raw TCP/UDP sockets, ADVAPI32 registry read/write (including Run-key persistence), token impersonation (OpenProcessToken / AdjustTokenPrivileges), process enumeration and injection primitives (VirtualAllocEx / WriteProcessMemory), and GDI/USER32 screen capture and clipboard APIs. Network indicators are not present in the outer PE; C2 configuration is inside the compiled script and requires AutoIt decompilation to recover.

Detection Signatures

References

• Artifact ID: 3b06e2a9-da8e-46b3-9945-12089b7e524d (OpenCTI)
• Source: MalwareBazaar / OpenCTI ingestion
• Related entity: unclassified-autoit-compiled — cluster overview and 16 prior siblings
• Related concept: autoit-compiled-script-dropper — deployment pattern documentation

Provenance

Analysis produced from triage.json, metadata.json, file.txt, pefile.txt, strings.txt, capa.txt, exiftool.json, rabin2-info.txt, ssdeep.txt, tlsh.txt, and yara.txt in the sample directory. capa v8.0.0 identified AutoIt compilation and halted further capability extraction. floss.py failed with argument-parsing error; no decoded strings available. No dynamic analysis — CAPE skipped due to no Windows guest. Static-only inference throughout.