unclassified-autoit-compiled: dca60b6b — DHL airway-bill lure, 493 KB encrypted SCRIPT resource, Dec 2024 build

Executive Summary

AutoIt v3 single-file compiled PE32 (AutoItSC) with a DHL airway-bill tracking social-engineering lure (COMMECIAL_INVOICE_AND_DHL_AWB_TRACKING_DETAILS.exe). Fifth-fifth confirmed sibling in the unclassified-autoit-compiled cluster. Dec 2024 build timestamp, MSVC 12.0 (VS 2013) linker, 11-icon suite, empty VS_VERSIONINFO. The 493 KB encrypted SCRIPT resource in .rsrc RT_RCDATA is opaque without decompilation; no plaintext C2, payload filenames, or shellcode strings recovered statically. Static-only analysis (no CAPE Windows guest).

What It Is

How It Works

This sample is a cluster sibling of the unclassified-autoit-compiled AutoItSC v3.3.8.1 single-file PE32 family. The binary itself is the AutoIt interpreter runtime fused with an encrypted compiled script. Threat logic lives entirely inside the 493 KB SCRIPT resource; the PE is merely the execution engine.

Build provenance: MSVC 12.0 linker (Visual Studio 2013) with a genuine Dec 2024 PE timestamp. This is consistent with the cluster's observed range (VS 2010 through VS 2017 linkers, timestamps spanning 2012–2024). The British English LangID and empty VS_VERSIONINFO are standard cluster fingerprints.

Social-engineering lure: The filename masquerades as a combined commercial invoice and DHL airway-bill tracking document — a logistics/procurement theme previously observed in sibling f618a861 (DHL_AWB_TRACKING_DETAILS.exe). Note the misspelling "COMMECIAL" (missing the 'R').

Encrypted script: The compiled AutoIt bytecode is encrypted and stored in RT_RCDATA resource ID SCRIPT with header AU3!EA06. Without the decompiler key, static analysis of the script logic is impossible. No plaintext payload filenames (e.g., biological/lexical nonce names), C2 endpoints, or shellcode staging strings were recovered from the binary strings.

Import surface: Standard AutoItSC runtime surface — 23 DLLs, 509 total imports. Network: WinInet (HTTP/FTP) + WinSock (TCP/UDP). Privilege/token: ADVAPI32 (RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, InitializeSecurityDescriptor, CheckTokenMembership). Process: KERNEL32 (VirtualAlloc, VirtualAllocEx, CreateThread, CreateProcessW). Clipboard: USER32 (OpenClipboard, GetClipboardData, SetClipboardData). Reconnaissance: PSAPI (GetProcessMemoryInfo), IPHLPAPI (IcmpSendEcho, IcmpCreateFile). UI: COMCTL32, GDI32, USER32 (full windowing/GDI surface). ^[pefile.txt]

No decompilation: The autoit-ripper/MyAut2Exe toolchain is not available on this host, and the encrypted script requires the original compiler key for decryption. Static analysis is therefore limited to runtime surface inference.

Decompiled Behavior

Ghidra analysis of the PE is low-yield because the binary is the AutoIt interpreter runtime, not the threat logic. The AutoIt script (493 KB encrypted bytecode) is the actual payload; decompilation would require MyAut2Exe or equivalent with the correct decryption key. ^[capa.txt]

Notable runtime functions visible in the interpreter:

• VirtualAlloc / VirtualAllocEx — RWX memory allocation for script execution ^[strings.txt:979,892]
• CreateThread / CreateProcessW — process/thread creation primitives ^[strings.txt]
• ShellExecuteExW / SHFileOperationW — file execution and manipulation ^[strings.txt:1229,1217]
• InternetOpenW / HttpSendRequestW / FtpOpenFileW — network I/O ^[strings.txt:829-834]

These are interpreter imports, not directly attacker-controlled call sites. The actual TTPs depend on the encrypted script content.

C2 Infrastructure

No C2 indicators recovered statically. The encrypted SCRIPT resource prevents string extraction. The WinInet + WinSock import surface implies HTTP/FTP or raw-socket C2 is plausible, but unconfirmed. ^[pefile.txt]

Interesting Tidbits

• Filename misspelling: "COMMECIAL" instead of "COMMERCIAL" — likely a typo by the operator, not automated. This exact string does not appear in sibling f618a861 (which used the correct spelling). ^[triage.json]
• 11-icon suite: Richer than the typical 4-icon cluster average, suggesting custom icon preparation for this lure. ^[pefile.txt:974-1679]
• PCRE regex runtime present: Full error-message table ("Inscriptional_Pahlavi", "Inscriptional_Parthian", "POSIX named classes", etc.) confirms the AutoIt script uses regular expressions, likely for data harvesting or C2 response parsing. ^[strings.txt:624-678]
• No payload nonce names: Unlike siblings 6718622d (emboweling/Lityerses), 763ae850 (ambiparous/Esher), or 54ad2eac (maneuverability/sulfhydric), this sample shows no biological/lexical nonce strings in plaintext. Either the names are generated at runtime from the encrypted script, or this variant uses a different staging scheme.
• 493 KB script size: Mid-range for the cluster (196 KB–1.11 MB observed). Larger than f618a861 (237 KB) but smaller than 5833e797 (1.11 MB).
• Build path absence: No D:\xampp\htdocs\... or similar build-path strings recovered, unlike sibling 0854c21e.

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 (or 3.3.14.x) on Windows. Compile with Aut2Exe to produce a single-file PE32.

Steps:

1. Write an AutoIt script with FileInstall, InetGet, RegWrite, and DllCall primitives.
2. Compile with Aut2Exe → Output.exe (single-file PE32).
3. Verify: strings Output.exe | grep "AU3!EA" — should show the SCRIPT header.
4. Verify: pefile or rabin2 -i — should show WinInet, WinSock, ADVAPI32, GDI imports.
5. Compare capa: capa Output.exe — will flag "autoit file limitation" and skip analysis.

What you'll learn: How AutoItSC binaries hide their actual logic inside encrypted .rsrc RT_RCDATA resources, and why static triage tools (capa, strings, floss) are blind to the real behavior.

Deployable Signatures

YARA Rule

rule AutoItSC_DHL_AWB_Lure_dca60b6b {
    meta:
        description = "AutoItSC v3 single-file compiled PE32 — DHL airway-bill / invoice lure variant"
        author = "PacketPursuit"
        date = "2026-07-20"
        hash = "dca60b6ba188e4f8886afd5002c8a4ab49e27f70e0c81dafa4cb3bbecfb3b38a"
    strings:
        $au3_hdr = "AU3!EA06"
        $autoit_str = "This is a third-party compiled AutoIt script."
        $pcre_err1 = "regular expression is too large"
        $pcre_err2 = "nothing to repeat"
        $pcre_script1 = "Inscriptional_Pahlavi"
        $pcre_script2 = "Inscriptional_Parthian"
        $wininet = "WININET.dll" ascii wide
        $winsock = "WSOCK32.dll" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x4550 and
        uint16(uint32(0x3C)+0x18) == 0x10B and
        ($au3_hdr or $autoit_str) and
        $wininet and
        $winsock and
        2 of ($pcre_err*) and
        1 of ($pcre_script*)
}

Behavioral Hunt Query (Sigma)

title: AutoItSC PE32 Execution with DHL/Invoice Lure Filename
description: Detects execution of AutoItSC compiled PE32 with logistics/invoice-themed filename pattern — cluster-wide behavior.
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        - Image|contains:
            - 'COMMECIAL_INVOICE'
            - 'DHL_AWB'
            - 'TRACKING_DETAILS'
            - 'Invoice.exe'
            - 'INVOICE.exe'
            - 'DHL_'
    selection_autoit:
        - CommandLine|contains: 'AutoIt'
        - Image|endswith:
            - '.exe'
        - Hashes|contains:
            - 'AU3'
    selection_imports:
        - LoadedImage|contains:
            - 'WININET.dll'
            - 'WSOCK32.dll'
    condition: selection_image or (selection_autoit and selection_imports)
falsepositives:
    - Legitimate AutoIt automation tools (rare in enterprise)
level: high

IOC List

Behavioral Fingerprint Statement

This binary is an AutoIt v3 single-file compiled PE32 interpreter runtime with an encrypted 493 KB SCRIPT resource embedded in .rsrc RT_RCDATA. On execution, the interpreter decrypts and executes the compiled AutoIt bytecode, which typically stages a secondary payload to %TEMP% via FileInstall, then injects shellcode via VirtualAlloc RWX + DllCallAddress at offset 0x23B0 (observed pattern in cluster siblings). The network surface (WinInet + WinSock imports) suggests HTTP/FTP or raw-socket C2 is present in the encrypted script. No plaintext C2 strings are recoverable without decompilation. The empty VS_VERSIONINFO and British English LangID are consistent cluster fingerprints.

Detection Signatures (capa → ATT&CK)

capa flagged the sample as AutoIt-compiled and declined analysis: autoit file limitation. No ATT&CK mappings are available from capa for this sample. Inferred mappings from cluster behavior and import surface:

References

• Artifact ID: a3cb29d5-e0a1-4bc2-a321-2d2078c0d81f
• OpenCTI labels: exe, malware-bazaar
• Related wiki pages: unclassified-autoit-compiled, autoit-compiled-script-dropper
• Cluster sibling (same DHL lure theme): f618a861 — DHL_AWB_TRACKING_DETAILS.exe, 237 KB SCRIPT, Jul 2024 build ^[/intel/analyses/f618a8619ab45629df06d80a6d5fec78962a679dbaaca29cf51cf9261973486f.html]

Provenance

• file.txt, exiftool.json, pefile.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, metadata.json, triage.json — generated by triage-fast.sh (May 2026)
• floss.txt — FireEye flare-floss (failed: CLI argument error; no decoded strings)
• capa.txt — Mandiant flare-capa v7 (AutoIt limitation warning; no capability hits)
• binwalk.txt — binwalk v2.3.4 (PE header + CRC32 table only)
• rabin2-info.txt — radare2 v5.x (binary header summary)
• dynamic-analysis.md — CAPE sandbox status (skipped: no Windows guest)
• Script resource extraction: custom Python + pefile (Jul 2026)