unclassified-autoit-compiled: e08d5bcef — RFQ engineering-document lure, 683 KB script in overlay

Executive Summary

AutoItSC v3.3.8.1 single-file PE32 dropper (RFQ_3001-_Enquiry_for_FRP_and_GRP_Tanks_pdf.exe) delivering an encrypted 683 KB compiled AutoIt script in the file overlay. This is the fifty-sixth confirmed sibling in the unclassified-autoit-compiled cluster. Distinctive traits: engineering-document lure (FRP/GRP tank procurement), .pdf.exe double-extension masquerade, overlay script placement (breaks autoit-ripper), and MSVC 10.0 (VS 2010) linker — older toolchain than the majority of 2023–2024 siblings. Static-only; no CAPE detonation.

What It Is

The binary is a standard AutoItSC runtime fused with a compiled/encrypted AutoIt v3 script. The AU3!EA06 header appears at overlay offset 0x16 (file offset 0x99410). ^[r2:strings] The overlay entropy of ~8.0 indicates strong encryption or compressed bytecode. autoit-ripper fails because it expects the script in a PE resource directory, not in the file overlay.

How It Works

1. Social engineering: The filename masquerades as a PDF document (RFQ_3001-_Enquiry_for_FRP_and_GRP_Tanks_pdf.exe) — a Request for Quotation for FRP/GRP tank procurement. The .pdf.exe double-extension exploits Windows "Hide extensions for known file types" default. ^[metadata.json:4]

2. Execution: On launch, the AutoItSC runtime decrypts and interprets the compiled script from the overlay. The script logic itself is opaque to static analysis without decompilation.

3. Payload delivery pattern (inferred from cluster): Based on cluster siblings, the decrypted script typically:

   • Drops one or two companion files to %TEMP% (often with biological/lexical nonce names)
   • Decodes hex-obfuscated shellcode via a custom AutoIt string-decoder function
   • Allocates RWX memory (VirtualAlloc) and executes shellcode at a fixed offset (commonly 0x23B0) via DllCallAddress
   • The shellcode builds a variable-length XOR key on the stack, decrypts the inner payload, and transfers execution

4. Novelty within cluster: This is the eleventh confirmed sibling with the script stored in the file overlay rather than .rsrc RT_RCDATA. Overlay placement breaks autoit-ripper and requires manual extraction. Previous overlay siblings: ff84806a, f346b7e9, e5647a2d, d990bd1b, a8beee89, 941a189b, 7768873f, fb5bc543, c7eabe28, 42c82e1d.

Decompiled Behavior

Radare2 analysis (level 2, 2412 functions) confirms a standard AutoItSC v3.3.8.1 runtime entry point. No novel C++ runtime behavior — the threat logic resides entirely in the encrypted script overlay. Key observations:

• Entry point at 0x004165C1 (standard AutoItSC GUI stub) ^[pefile.txt:50]
• Import surface: Full WinInet/WinSock/ADVAPI32/GDI/PSAPI/USERENV/MPR/COMCTL32 surface — the complete AutoIt runtime API set ^[r2:imports]
• No exports, no TLS callbacks, no manifest anomalies ^[pefile.txt:160]
• PE sections: .text (entropy 6.68), .rdata (4.80), .data (2.15), .rsrc (4.54) ^[pefile.txt:92,112,132,152]
• Resources in .rsrc: Four icon resources (RT_ICON groups 0x63, 0xA2, 0xA4, 0xA9) and version info (RT_VERSION) ^[r2:sections]
• PCRE regex runtime embedded in .text — full Unicode script-name table and error-message strings present ^[strings.txt:449]

No Ghidra decompilation attempted; the C++ runtime is standard AutoItSC and the script is encrypted. Threat logic requires AutoIt decompiler (e.g., MyAut2Exe) on the extracted overlay.

C2 Infrastructure

No plaintext C2 indicators recovered. The AutoItSC import table includes InternetOpenW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, WSAStartup, socket, connect — sufficient for HTTP or raw TCP C2, but no hostnames, IPs, URLs, or mutex names present in the binary. ^[strings.txt:557]

Dynamic execution (CAPE) was skipped — no Windows guest available. C2 inference is static-only and speculative.

Interesting Tidbits

• Engineering-document lure: Unlike the majority of siblings that use generic procurement/invoice/DHL themes, this sample targets industrial engineering procurement (FRP/GRP tanks — fiber-reinforced plastic / glass-reinforced plastic storage tanks). This suggests targeting of manufacturing, chemical, or water-treatment verticals.
• MSVC 10.0 linker: Most 2023–2024 siblings use MSVC 12.0–14.16 (VS 2013–2017). This sample uses VS 2010 (linker 10.0), making it one of the oldest-toolchain siblings in the cluster alongside ff84806a, 42c82e1d, 7768873f, and 941a189b. The fabricated Jan 2012 PE timestamp is consistent with this toolchain age.
• Overlay script header anomaly: The overlay begins with a3 48 4b be 98 6c 4a a9 99 4c 53 0a 86 d6 48 7d before the AU3!EA06 marker — a 16-byte prefix not observed in all siblings. This may be an additional encryption layer or a file-inclusion artefact.
• No UPX packing: Plain PE32 (non-UPX). Some cluster siblings are UPX-packed transports (68e48a8c, 498f7bf3, 6cc26f7c, c310cb2e, d86e0912).
• YARA: Only generic hits (PE_File_Generic, Suspicious_Wininet_Imports) — no family-specific YARA rule exists for this cluster.

How To Mess With It (Homelab Replication)

Goal: Build a comparable AutoItSC dropper with a hidden script payload.

1. Toolchain: Install AutoIt v3.3.8.1 on Windows. Write an AutoIt script (payload.au3) that downloads a file or drops a companion executable.
2. Compile: Use Aut2Exe.exe (included with AutoIt) with /in payload.au3 /out dropper.exe. Select "Use UPX" optionally.
3. Verify script placement: Check if the script is in .rsrc or overlay using Resource Hacker or rabin2 -S. For overlay placement, some AutoItSC versions default to this.
4. Verify extraction: Attempt autoit-ripper dropper.exe out/ — if it fails with "Couldn't find the script resource", you have an overlay-placed sample matching this sibling.
5. Static fingerprint: Run strings and confirm AU3!EA06, AutoIt v3 Script: 3, 3, 8, 1, full PCRE error-message table, and WinInet/WinSock imports.

What you'll learn: How the AutoItSC runtime maps compiled script storage and why overlay placement evades automated extraction tools.

Deployable Signatures

YARA Rule

rule AutoItSC_Unclassified_Cluster {
    meta:
        description = "Unclassified AutoItSC v3.3.8.1 single-file PE32 cluster — generic family signature"
        author = "PacketPursuit"
        date = "2026-07-20"
        sha256 = "e08d5bcefbe1a2672589b457ddf11c7f2bfcb9d2151b75cea5213b820e56dc95"
    strings:
        $au3 = "AU3!EA06" ascii
        $autoit = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support." ascii
        $ver = "AutoIt v3 Script: 3, 3, 8, 1" ascii
        $pcre1 = "PCRE does not support \\L, \\l, \\N{name}, \\U, or \\u" ascii
        $pcre2 = "numbers out of order in {} quantifier" ascii
        $pcre3 = "unrecognized character after (? or (?-" ascii
    condition:
        uint16(0) == 0x5A4D and
        $au3 and
        $autoit and
        $ver and
        2 of ($pcre*)
}

Behavioral Fingerprint

This binary is an AutoItSC-compiled PE32 with a large encrypted script payload (200 KB–1 MB). On execution, the AutoIt interpreter decrypts and runs the compiled script. Observed cluster behavior includes: dropping companion payloads to %TEMP% with biological/lexical nonce filenames, decoding hex-obfuscated shellcode via custom AutoIt string-decoder functions, allocating RWX memory via VirtualAlloc, executing shellcode at offset 0x23B0 via DllCallAddress, and process-hollowing svchost.exe or .NET RegSvcs.exe. Inner payloads have included AgentTesla infostealer and unattributed stripped PE32 payloads.

IOC List

Detection Signatures (capa → ATT&CK)

Capa flagged an autoit file limitation and refused further analysis. ^[capa.txt:5] No ATT&CK capabilities were extracted. Static inference from the import table and cluster behavior maps to:

References

• Artifact ID: 596778b1-0777-4f96-8d2c-31d81a7694c9 (OpenCTI)
• Source: MalwareBazaar
• Cluster entity: unclassified-autoit-compiled
• Related concept: autoit-compiled-script-dropper
• Related technique: autoit-shellcode-xor-decryptor
• Related technique: callwindowproc-shellcode-injection
• Related technique: autoit-overlay-script-placement

Provenance

Analysis derived from:

• file.txt — file command output (PE32 GUI x86, 4 sections)
• exiftool.json — ExifTool metadata (AutoIt v3.3.8.1, VS 2010 linker, British English)
• pefile.txt — pefile structural analysis (sections, imports, VS_VERSIONINFO)
• rabin2-info.txt — radare2 binary header (overlay=true, MSVC 10.0, Jan 2012 timestamp)
• strings.txt — strings output (AutoIt markers, PCRE runtime, API names)
• capa.txt — Mandiant capa v8.x (AutoIt file limitation)
• yara.txt — YARA matches (generic PE + WinInet)
• ssdeep.txt, tlsh.txt — Fuzzy hashes
• Radare2 r2 analysis (level 2, 2412 functions) — imports, sections, strings
• Manual Python overlay extraction and entropy calculation
• autoit-ripper extraction attempt (failed — script in overlay, not resource)

Report generated 2026-07-20. Static-only analysis — no dynamic execution available.