unclassified-autoit-compiled: ded287fe — Bangladesh IT-park lure with 805 KB encrypted SCRIPT resource

Executive Summary

AutoItSC single-file PE32 compiled Sep 2024 with a 805 KB encrypted SCRIPT resource — the largest script payload yet observed in this cluster. Filename masquerades as a Bangladesh technology-park development project (ITHitech_Park_Project,_Bangladesh.exe). Empty VS_VERSIONINFO, 15 embedded icon sizes, full PCRE regex runtime, and the standard WinInet/WinSock/ADVAPI32/GDI import surface. No UPX packing; no overlay. Static-only analysis.

What It Is

• SHA-256: ded287fe446fde8886980755b85e296b7cccd68b9abb03bd62c0795da471c4f2
• Size: 1,720,832 bytes (1.64 MB)
• File type: PE32 executable (GUI) Intel 80386, 5 sections ^[file.txt]
• Compile stamp: Mon Sep 16 02:29:59 2024 UTC ^[pefile.txt:34]
• Linker: Microsoft linker 14.16 (VS 2017/2019) ^[exiftool.json:18]
• Filename lure: ITHitech_Park_Project,_Bangladesh.exe — industrial/development-project social engineering ^[metadata.json:4]
• Packing: None (non-UPX) ^[binwalk.txt]
• Signing: Unsigned ^[rabin2-info.txt:30]
• Script placement: .rsrc type 10 (SCRIPT), 805,514 bytes, encrypted with AU3!EA06 header ^[strings.txt:1418, strings.txt:2766]
• Overlay: None ^[pefile.txt]

This is the twentieth confirmed sibling of the unclassified-autoit-compiled cluster.

How It Works

The binary is a standard AutoIt v3 single-file compiler (AutoItSC) output: the interpreter runtime (C++ compiled with MSVC 14.16) and the compiled AutoIt script bytecode are fused into one PE. At runtime the interpreter decrypts/decompresses the SCRIPT resource and executes it. The script logic itself is opaque to static analysis — the AU3!EA06 format is not plain text and requires MyAut2Exe or similar tooling to recover source.

The 805 KB script is 3 KB larger than the previous cluster maximum (d86e0912, 802 KB). Given the cluster's script sizes range from 183 KB to 932 KB, this sample sits near the top of the distribution, suggesting either a feature-rich build or a large embedded payload (second-stage dropper, credential harvester, or RAT plugin).

Decompiled Behavior

Ghidra decompilation is not pursued here because the threat logic lives inside the encrypted AutoIt script, not in the C++ runtime. The runtime is the standard AutoItSC v3 interpreter with these observable behaviors via its import table:

• Process creation / injection primitives: CreateProcessW, CreateProcessAsUserW, CreateProcessWithLogonW, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateThread, TerminateThread, ResumeThread ^[pefile.txt]
• Network C2 client: WSOCK32 (raw TCP/UDP sockets, connect, send, recv, gethostbyname) + WININET (HTTP/FTP, HttpOpenRequestW, HttpSendRequestW, InternetOpenUrlW, FtpOpenFileW) ^[pefile.txt]
• Registry persistence / reconnaissance: RegOpenKeyExW, RegCreateKeyExW, RegSetValueExW, RegEnumKeyExW, RegDeleteKeyW, RegDeleteValueW, RegQueryValueExW, RegConnectRegistryW ^[pefile.txt]
• Credential / token abuse: LogonUserW, OpenProcessToken, OpenThreadToken, DuplicateTokenEx, AdjustTokenPrivileges, LookupPrivilegeValueW, CreateProcessAsUserW, CreateProcessWithLogonW ^[pefile.txt]
• Discovery: CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, GetSystemInfo, IsWow64Process, GetFileAttributesW, FindFirstFileW, IcmpSendEcho ^[pefile.txt]
• Collection: GetAsyncKeyState, GetKeyboardState, SetKeyboardState, keybd_event (keylogging); OpenClipboard, GetClipboardData, EmptyClipboard, SetClipboardData (clipboard); GetDC, CreateCompatibleDC, BitBlt-adjacent GDI primitives (screenshot) ^[pefile.txt]
• Evasion: IsDebuggerPresent ^[pefile.txt]

The full PCRE regex runtime strings confirm script-side pattern matching/harvesting capability. ^[strings.txt:600-635]

C2 Infrastructure

No hardcoded C2 strings recovered from the binary. The AutoIt script is encrypted; network endpoints are likely runtime-resolved or stored in the script's string table. Dynamic analysis would be required to observe actual C2.

Interesting Tidbits

• Largest SCRIPT resource in cluster: 805,514 bytes, surpassing d86e0912 (802 KB) by a narrow margin. ^[strings.txt:1418]
• Empty VS_VERSIONINFO: StringFileInfo block has zero-length values; only the LangID (0809 04B0 = British English) and Translation ID are populated. ^[pefile.txt:251-272]
• 15-icon suite: Eleven RT_ICON resources (16×4 to 256×256) plus group-icon metadata. ^[pefile.txt]
• No overlay: Unlike siblings ff84806a, f346b7e9, e5647a2d, fb5bc543, and d990bd1b6 which store the script in the file overlay, this sample places it in .rsrc — the more common placement for post-2020 builds. ^[pefile.txt]
• PCRE regex library: Full error-message table present, confirming script-side regex compilation for data harvesting. ^[strings.txt:569-655]
• Manifest declares Common Controls 6.0 and five supported OS IDs (Vista through Windows 10). ^[strings.txt:2770]

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.16.1 + SciTE editor on Windows 10/11 VM.

1. Write an AutoIt script that uses InetGet(), RegWrite(), and Run().
2. Compile with Tools → Compile Script (x86) → set Output to "Single File (x86)".
3. Verify the output PE has a .rsrc type 10 SCRIPT resource and the AU3!EA06 header.
4. Run capa on the compiled EXE — it should hit the same AutoIt limitation warning as this sample. ^[capa.txt]
5. Compare import tables: WSOCK32 + WININET + ADVAPI32 + SHELL32 + GDI32 + USER32 + ole32 + OLEAUT32 should all be present.

What you'll learn: How a legitimate automation language becomes an evasive malware loader simply by compiling the script into a PE.

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PE32_LargeScript_Bangladesh_Lure
{
    meta:
        description = "AutoItSC single-file PE32 with large encrypted SCRIPT resource and IT-park lure"
        author = "PacketPursuit"
        reference = "ded287fe446fde8886980755b85e296b7cccd68b9abb03bd62c0795da471c4f2"
        date = "2026-06-26"
        confidence = "high"
    strings:
        $autoit_hdr = "AU3!EA06"
        $autoit_sc = ".text$lp00AutoItSC"
        $autoit_msg = "This is a third-party compiled AutoIt script."
        $pcre_utf = "this version of PCRE is compiled without UTF support"
        $pcre_js = "] is an invalid data character in JavaScript compatibility mode"
        $wininet = "WININET.dll"
        $wsock32 = "WSOCK32.dll"
        $advapi = "ADVAPI32.dll"
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        uint16(uint32(0x3C)+0x18) == 0x010B and
        3 of ($autoit_*) and
        all of ($pcre_*) and
        $wininet and
        $wsock32 and
        $advapi
}

Behavioral Hunt Query (Sigma-like)

title: AutoIt Compiled PE Spawn Suspicious Child or Network
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    - Image|endswith:
        - '\\AutoIt3.exe'
        - '\\AutoItSC.exe'
    - CommandLine|contains:
        - '.exe'
        - 'AutoIt'
  selection_suspicious:
    - CommandLine|contains:
        - 'reg add'
        - 'schtasks'
        - 'powershell'
        - 'cmd.exe /c'
        - 'net use'
        - 'regsvr32'
        - 'rundll32'
    - InitiatedConnection: true
  condition: selection_parent and selection_suspicious
falsepositives:
  - Legitimate AutoIt automation scripts in enterprise environments
level: medium

IOC List

Behavioral Fingerprint

This binary is a single-file AutoIt v3 compiled PE32 (GUI, x86) with a large encrypted SCRIPT resource in .rsrc (805 KB). It loads WSOCK32 and WININET for network communication, ADVAPI32 for registry manipulation and token abuse, and USER32/GDI32 for keylogging, clipboard access, and screen capture. The PCRE regex runtime is embedded, suggesting script-side data harvesting. No UPX packing. Empty VS_VERSIONINFO. Unsigned. Typical lure themes are business-document filenames (invoice, procurement, shipping, RFQ, banking, government agency, or — in this case — IT development project). Static analysis of the script is blocked by the AU3!EA06 compiled bytecode format.

Detection Signatures

References

• unclassified-autoit-compiled — cluster entity page
• autoit-compiled-script-dropper — concept page covering single-file and two-file AutoIt deployment patterns
• MalwareBazaar artifact ID: 1528230a-bc03-4e4f-9cc4-9d246bdf0eef

Provenance

• file.txt — file(1) output
• exiftool.json — ExifTool 12.76 metadata
• pefile.txt — pefile 2023.x full PE dump
• rabin2-info.txt — radare2 binary header summary
• strings.txt — strings(1) output
• capa.txt — Mandiant FLARE capa (AutoIt limitation warning)
• binwalk.txt — binwalk 2.3.x embedded artifact scan
• metadata.json — OpenCTI connector artifact metadata
• triage.json — triage-fast classification record
• floss.txt — flare-floss (failed due to argument error)
• Manual pefile Python inspection for resource enumeration, import table extraction, and icon counting