unclassified-autoit-compiled: d990bd1b — 327 KB overlay script, Jan 2012 timestamp, banking/SOA lure

Executive Summary

Nineteenth confirmed sibling in the unclassified-autoit-compiled cluster. PE32 x86 AutoItSC v3.3.8.1 single-file compiled binary with 327 KB encrypted script stored in file overlay (not .rsrc), Payment_Reference_SOA_Pending_Balance_Updated.exe banking-lure filename, and Jan 2012 PE timestamp. Fourth sibling confirmed with overlay script placement.

What It Is

SHA-256: d990bd1b64d3875667e04aa35e36697d4c85e5a704676afb4cacee346638dd11
File: Payment_Reference_SOA_Pending_Balance_Updated.exe^[metadata.json]
Size: 1,018,887 bytes (995 KB)
Type: PE32 executable (GUI) Intel 80386, for MS Windows^[file.txt]
Timestamp: Sun Jan 29 21:32:28 2012 UTC (AutoItSC v3.3.8.1 runtime)^[pefile.txt:34]
Script placement: File overlay, 327,687 bytes, AU3!EA06 header at offset 16^[pefile.txt:1048]
Linker: Microsoft linker 10.0 (VS 2010-era)^[pefile.txt:46]
Signing: Unsigned^[rabin2-info.txt:27]
VS_VERSIONINFO: Empty FileDescription, only CompiledScript: AutoIt v3 Script: 3, 3, 8, 1^[exiftool.json:38]

How It Works

The binary is a standard AutoItSC single-file PE32. The compiled script bytecode is stored in the file overlay (not .rsrc), starting at offset 0xA8C00 (691,200 bytes) with AU3!EA06 magic at offset 0xA8C10. The overlay is 327,687 bytes (~320 KB), mid-large compared to cluster siblings.^[pefile.txt:1048] The outer PE is the AutoIt v3.3.8.1 interpreter runtime with standard imports (WSOCK32, WININET, ADVAPI32, SHELL32, etc.). Threat logic lives entirely in the encrypted script overlay; static analysis cannot recover the original AutoIt BASIC source. For cluster behavior, see unclassified-autoit-compiled.

Decompiled Behavior

Not applicable — AutoItSC compiled scripts are encrypted bytecode, not native x86 instructions. Ghidra decompiles the interpreter stub only; the script payload requires AutoIt-specific decompilation tools (e.g., MyAut2Exe) which are outside current toolchain scope.^[capa.txt:5]

C2 Infrastructure

None observable statically. The AutoIt runtime imports WinInet and WSOCK32 APIs, but no URLs, IPs, domains, or C2 configuration strings are present in the outer binary. C2 is runtime-resolved by the compiled script.^[strings.txt]

Interesting Tidbits

Overlay script placement: Matches ff84806a, e5647a2d, and fb5bc543 — the fourth confirmed sibling with this placement pattern.^[pefile.txt:1048]
Filename lure: Payment_Reference_SOA_Pending_Balance_Updated.exe — Statement-of-Account / banking-themed social engineering.^[metadata.json:4]
Jan 2012 timestamp: Fourth sibling with this specific PE timestamp (0x4F25BAEC), suggesting shared AutoItSC runtime version or deliberate timestamp selection.^[pefile.txt:34]
Overlay size: 327 KB — smaller than ff84806a (694 KB), e5647a2d (710 KB), and fb5bc543 (690 KB), but larger than the smallest cluster sibling (f51bc678 at 196 KB).^[pefile.txt:1048]
Linker version: 10.0 (VS 2010) — older than the MSVC 14.x siblings seen post-2020, consistent with Jan 2012 timestamp era.^[pefile.txt:46]
Icon suite: Four icons (0x63, 0xA2, 0xA4, 0xA9) in .rsrc — standard AutoItSC RT_GROUP_ICON structure.^[pefile.txt:1336-1416]
PCRE regex library: Full PCRE error-message and Unicode script-name table present in .rdata, matching cluster trait.^[strings.txt:445-499]

How To Mess With It (Homelab Replication)

Toolchain: Install AutoIt v3.3.8.1 on Windows XP/7/10 VM.
Script: Write a banking-lure themed .au3 script with WinInet HTTP download and RegWrite persistence.
Compile: Use AutoItSC single-file compiler: Aut2Exe.exe /in script.au3 /out Payment_Reference_SOA.exe.
Verify: Run capa — should match autoit file limitation warning.^[capa.txt:5]
Extract: Use myaut2exe or exe2aut to recover the .au3 source from the overlay.

Deployable Signatures

YARA Rule

rule AutoItSC_Banking_Lure_Overlay {
    meta:
        description = "AutoItSC single-file PE32 with banking/SOA filename lure and overlay script"
        author = "PacketPursuit"
        date = "2026-06-25"
        sha256 = "d990bd1b64d3875667e04aa35e36697d4c85e5a704676afb4cacee346638dd11"
    strings:
        $au3_header = "AU3!EA06"
        $compiled = "CompiledScript: AutoIt v3 Script" nocase
        $pe = { 4D 5A }
        $soa = "SOA" nocase
        $payment = "Payment" nocase
    condition:
        $pe at 0 and $au3_header and ($soa or $payment) and filesize > 500KB
}

IOC List

SHA-256: d990bd1b64d3875667e04aa35e36697d4c85e5a704676afb4cacee346638dd11
Filename: Payment_Reference_SOA_Pending_Balance_Updated.exe
Overlay offset: 0xA8C00 (691,200 bytes)
Overlay size: 327,687 bytes
Overlay magic: AU3!EA06 at offset 0xA8C10
PE Timestamp: 0x4F25BAEC (Sun Jan 29 21:32:28 2012 UTC)
Linker: 10.0
Imports: WSOCK32, WININET, ADVAPI32 (standard AutoItSC surface)

Behavioral Fingerprint

This binary is a single-file AutoItSC PE32 with ~320 KB encrypted script stored in file overlay (not .rsrc). It executes the AutoIt interpreter, which at runtime decrypts and runs the embedded script. The script likely performs banking/SOA-themed social-engineering followed by network C2 and/or persistence. The outer PE has no malicious imports beyond standard AutoIt runtime APIs; all threat behavior is inside the encrypted overlay.

Detection Signatures

capa: autoit file limitation — compiled AutoIt script detected.^[capa.txt:5]
YARA: PE_File_Generic, Suspicious_Wininet_Imports — generic hits, not family-specific.^[yara.txt]

References

[unclassified-autoit-compiled](/intel/families/unclassified-autoit-compiled.html) — cluster entity page
[autoit-compiled-script-dropper](/intel/concepts/autoit-compiled-script-dropper.html) — concept page
MalwareBazaar source (no direct URL in metadata)

Provenance

Analysis derived from:

file.txt — file(1) identification
exiftool.json — VS_VERSIONINFO extraction
pefile.txt — PE header, sections, imports, resource directory, overlay analysis
strings.txt — static string extraction (ASCII/Unicode)
capa.txt — capability detection (AutoIt limitation warning)
yara.txt — generic YARA hits
rabin2-info.txt — radare2 binary summary
metadata.json — OpenCTI artifact metadata

> Analysis · d990bd1b64d3_