unclassified-autoit-compiled: e5647a2d — 1.36 MB invoice-lure with 710 KB encrypted script in overlay

Executive Summary

Thirteenth confirmed sibling of the unclassified-autoit-compiled AutoItSC single-file PE32 cluster. Compiled AutoIt v3 script (#INV-24090166.exe, 1.36 MB) with a 710 KB encrypted script payload stored in the file overlay rather than the more common .rsrc RT_RCDATA placement. Jan 2012 PE timestamp, AutoItSC v3.3.8.1 runtime, full WinInet/WinSock/ADVAPI32/GDI import surface. Invoice-themed social-engineering lure. Static-only analysis; CAPE skipped due to absent Windows guest.

What It Is

• SHA-256: e5647a2dedd25289341cc36131ea33f2404e652c38eb81ac4d18f89898a65f04
• Original filename: #INV-24090166.exe
• Size: 1,359,531 bytes (1.36 MB)
• File type: PE32 executable (GUI) Intel 80386, 4 sections^[file.txt]
• PE timestamp: Sun Jan 29 21:32:28 2012 UTC (0x4F25BAEC)^[pefile.txt:34]
• Linker: Microsoft linker 10.0 (VS 2010 era)^[pefile.txt:45-46]
• AutoIt version: v3.3.8.1 (from VS_VERSIONINFO CompiledScript string)^[exiftool.json]
• Signing: Unsigned — Security directory empty, no Authenticode^[pefile.txt]
• Overlay: 710,315 bytes appended past the .rsrc section end^[terminal:overlay-extraction]

Cluster placement: This sample belongs to the unclassified-autoit-compiled entity, which now has thirteen confirmed siblings. It is the second-largest script payload in the cluster (710 KB, behind f0059bee at 932 KB) and one of only three siblings that store the script in the file overlay rather than as an RT_RCDATA resource inside .rsrc (the others being ff84806a and f346b7e9).

How It Works

Build / RE

The binary is a direct output of the AutoIt v3 single-file compiler (AutoItSC.exe). The runtime is a statically-linked MSVC C++ PE32 that embeds the AutoIt interpreter, the standard library, and the compiled script bytecode in a single executable.

Script placement — overlay, not .rsrc The .rsrc section is 37,888 bytes and contains only the standard AutoIt runtime resources: 12 RT_ICON entries, RT_MENU, RT_DIALOG, RT_STRING (AutoIt error-message tables), RT_VERSION, and RT_MANIFEST^[pefile.txt:916-1400]. No SCRIPT resource is present. Instead, a 710,315-byte overlay begins at file offset 0x9EC00 (immediately after .rsrc ends). The overlay starts with 16 bytes of encrypted data, followed by the AU3!EA06 compiled-script header at overlay offset 16^[terminal:xxd-tail, terminal:overlay-extraction]. This matches the overlay-placement pattern previously observed in ff84806a (694 KB script) and f346b7e9 (659 KB script).

Import surface 16 DLLs, 509 total imports — the full AutoIt runtime surface:

• KERNEL32.DLL (159): process/thread/memory/file/pipe/registry manipulation, IsDebuggerPresent, CreateToolhelp32Snapshot, VirtualAllocEx/WriteProcessMemory/ReadProcessMemory^[pefile.txt:267-425]
• USER32.DLL (160): window management, keyboard/mouse input (SendInput, GetAsyncKeyState, BlockInput), clipboard (OpenClipboard, GetClipboardData, SetClipboardData), screenshot primitives (GetDC, BitBlt via GDI)^[pefile.txt:664-824]
• GDI32.DLL (35): drawing, bitmap capture, font manipulation^[pefile.txt:509-544]
• WININET.DLL (14): full HTTP/FTP client — InternetOpenW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, InternetOpenUrlW, FtpOpenFileW^[pefile.txt:858-872]
• WSOCK32.DLL (22): raw TCP/UDP socket API including socket, connect, send, recv, bind, listen, WSAStartup^[pefile.txt:893-915]
• ADVAPI32.dll (34): registry read/write, service control (OpenSCManagerW), token manipulation (OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges), CreateProcessAsUserW, LogonUserW^[pefile.txt:435-468]
• SHELL32.dll (14): ShellExecuteExW, SHGetFolderPathW, SHFileOperationW, drag-and-drop^[pefile.txt:641-654]
• PSAPI.DLL (4): EnumProcesses, EnumProcessModules^[pefile.txt:628-631]
• MPR.dll (4): network drive mapping (WNetAddConnection2W)^[pefile.txt:553-556]
• USERENV.dll (4): user profile load/unload^[pefile.txt:833-836]
• ole32.dll, OLEAUT32.dll, COMCTL32.dll, COMDLG32.dll, VERSION.dll, WINMM.dll: COM/OLE/variant automation, common controls, dialogs, version queries, multimedia^[pefile.txt:566-617]

No packing: UPX test confirms not packed^[terminal:upx-test]. Section .text entropy 6.68 — high but consistent with a large AutoIt runtime + compiled script, not indicative of additional packing^[pefile.txt:92].

capa limitation: capa identified the binary as compiled AutoIt and refused further analysis, recommending MyAut2Exe or manual review^[capa.txt]. This is expected for AutoItSC binaries and confirms the toolchain classification.

YARA matches: PE_File_Generic, Suspicious_Wininet_Imports^[yara.txt].

Deploy / ATT&CK

Because the compiled script is encrypted and no decompiler is available on this host, dynamic behavior must be inferred from the runtime import surface and cluster history.

Persistence: No static persistence strings (e.g., Run registry key paths) were recovered from the encrypted overlay. The AutoIt runtime exposes RegSetValueExW and RegCreateKeyExW, so registry-based persistence is plausible at script runtime. No scheduled-task or service strings were visible in the static strings dump.

C2: No hardcoded URLs, IPs, or domains were recovered from the overlay — the script is encrypted. The WinInet + WinSock dual-stack import surface suggests HTTP/HTTPS or raw TCP C2, but specific endpoints are not inferable statically. Cluster siblings have shown varied C2 patterns (HTTP downloaders, raw TCP beacons, FTP exfil), so this sample's exact C2 would require dynamic detonation or successful AutoIt decompilation.

Anti-analysis: The AutoIt compiled-script encryption itself provides natural static obfuscation — capa cannot analyze it, strings extraction yields only runtime noise, and the script logic is inaccessible without decompilation. No additional anti-debug or anti-VM checks were observed in the PE imports or strings.

Decompiled Behavior

Ghidra and radare2 analysis were not performed. The binary is a compiled AutoIt interpreter runtime with an encrypted script payload; reverse engineering the C++ runtime would reveal only the AutoIt standard library (process creation, window manipulation, network I/O) and not the actual malware logic, which lives inside the encrypted overlay. Decompilation of the runtime would not meaningfully advance attribution or behavioral understanding beyond what the import table already reveals.

C2 Infrastructure

• Static C2: Not recoverable — script encrypted in overlay.
• Dynamic C2: Would require CAPE detonation or successful AutoIt decompilation.
• Network APIs available: HTTP/HTTPS (WinInet), FTP (WinInet), raw TCP/UDP (WinSock), ICMP (IcmpCreateFile/IcmpSendEcho from ICMP.DLL)^[strings.txt:517-521].

Interesting Tidbits

• Invoice lure naming: #INV-24090166.exe follows the procurement/invoice theme common to this cluster (Invoice.exe, PO_#86637.exe, PO-A1702108.exe, PO20240627-001.exe). The numeric string 24090166 suggests an invoice or purchase-order reference number.
• Overlay placement anomaly: Only 3 of 13 siblings store the script in the overlay (ff84806a, f346b7e9, e5647a2d). The rest use .rsrc RT_RCDATA ID SCRIPT. The overlay placement may be an older AutoItSC compiler behavior or a post-build modification.
• PCRE regex runtime: The AutoIt runtime in this binary includes the PCRE (Perl Compatible Regular Expressions) library, evidenced by error-message strings in the .rsrc RT_STRING table ("syntax error in subpattern name", "invalid data character in JavaScript compatibility mode")^[strings.txt:464-512]. This enables script-side pattern matching for credential harvesting, data exfiltration filtering, or C2 command parsing.
• ICMP reconnaissance: Imports IcmpCreateFile and IcmpSendEcho from ICMP.DLL^[strings.txt:518-520], suggesting network reconnaissance or C2 reachability checks may be performed by the script.
• Token manipulation surface: Full privilege-escalation import chain (OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, LogonUserW, CreateProcessAsUserW)^[pefile.txt:446-449,455,465] — the script can escalate to SYSTEM or spawn processes under alternate credentials.
• No Authenticode: Unsigned, consistent with the cluster pattern (all 13 siblings are unsigned).^[pefile.txt:173-174]

How To Mess With It (Homelab Replication)

Goal: Build a comparable AutoItSC single-file PE to understand the compiler output and test static-analysis limitations.

Toolchain:

• AutoIt v3.3.8.1 (or latest stable) from https://www.autoitscript.com
• SciTE4AutoIt3 editor
• Windows build host (the compiler is Windows-only)

Steps:

1. Install AutoIt v3.3.8.1 full package (includes AutoItSC.exe).
2. Write a simple script (test.au3) that exercises network and file APIs:

   #include <InetConstants.au3>
   $sURL = "https://example.com/test"
   $sData = InetRead($sURL, 1)
   FileWrite(@TempDir & "\test.dat", $sData)
   

3. Compile with AutoItSC.exe /in test.au3 /out test.exe (right-click → Compile Script in SciTE).
4. Inspect with pefile, strings, and capa. Expect:
   • PE32 x86 GUI, 4-5 sections
   • AU3!EA06 header in .rsrc or overlay
   • WinInet/WinSock imports
   • capa refusal with AutoIt limitation warning
5. Compare capa output to this sample's capa.txt — should hit the same limitation rule.

What you'll learn: How compiled AutoIt binaries defeat static string extraction, why capa refuses them, and how the overlay-vs-resource placement varies across compiler versions.

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PE32_InvoiceOverlay
{
    meta:
        description = "AutoItSC v3 single-file PE32 with large encrypted script overlay, invoice-themed filename"
        author = "PacketPursuit SOC"
        date = "2026-06-20"
        sha256 = "e5647a2dedd25289341cc36131ea33f2404e652c38eb81ac4d18f89898a65f04"
        family = "unclassified-autoit-compiled"
    strings:
        $au3_header = "AU3!EA06" ascii
        $autoit_err1 = "AutoIt has detected the stack has become corrupt" wide
        $autoit_err2 = "Badly formatted \"Func\" statement" wide
        $autoit_err3 = "Unable to load the internet libraries" wide
        $wininet = "WININET.dll" ascii
        $wsock = "WSOCK32.dll" ascii
        $icmplib = "ICMP.DLL" ascii
        $inv_lure1 = "INV-" ascii nocase
        $inv_lure2 = "Invoice" ascii nocase
        $po_lure1 = "PO_" ascii nocase
        $po_lure2 = "PO-" ascii nocase
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        $au3_header and
        ($wininet or $wsock) and
        (filesize > 1MB) and
        // Large overlay indicator: .rsrc section ends well before EOF
        (filesize - (pe.sections[pe.number_of_sections-1].raw_data_offset + pe.sections[pe.number_of_sections-1].raw_data_size) > 500KB) and
        any of ($inv_lure*, $po_lure*)
}

IOC List

Behavioral Fingerprint

This binary is a compiled AutoIt v3 single-file PE32 executable. On launch, the AutoIt interpreter runtime initializes and decrypts/loads a ~710 KB compiled script payload stored in the file overlay (not the .rsrc section). The runtime exposes the full Windows API surface: WinInet for HTTP/FTP, WinSock for raw TCP/UDP, GDI/USER32 for screen capture and clipboard access, ADVAPI32 for registry manipulation and token privilege escalation, and PSAPI for process enumeration. The script itself is encrypted and not statically analyzable without decompilation. No persistence mechanism is visible in the PE static footprint; any persistence would be enacted by the script at runtime. The binary is unsigned and carries a Jan 2012 PE timestamp with AutoItSC v3.3.8.1 version info.

Detection Signatures (capa → ATT&CK)

capa refused analysis with the AutoIt file limitation rule^[capa.txt]. No ATT&CK mappings are available from capa for this sample.

Static-derived ATT&CK mappings are listed in the Deploy / ATT&CK section above.

References

• Artifact ID: 7ad61afa-a554-404f-bfa8-2ad04e8c4b7c (OpenCTI ingestion)
• Source: MalwareBazaar via OpenCTI connector
• Cluster entity page: unclassified-autoit-compiled
• Concept page: autoit-compiled-script-dropper
• Related sibling analyses:
  • ff84806a — oldest overlay-placement sibling (694 KB script, Jan 2012)^[raw/analyses/ff84806a.../report.md]
  • f346b7e9 — second overlay-placement sibling (659 KB script)^[raw/analyses/f346b7e9.../report.md]
  • f0059bee — largest script in cluster (932 KB in .rsrc)^[raw/analyses/f0059bee.../report.md]

Provenance

Analysis based on:

• file.txt — file(1) output
• exiftool.json — ExifTool 12.76 PE metadata
• pefile.txt — pefile.py full PE dump
• strings.txt — GNU strings -n 4 output
• capa.txt — Mandiant capa v7 (AutoIt limitation warning)
• yara.txt — YARA rules: PE_File_Generic, Suspicious_Wininet_Imports
• ssdeep.txt / tlsh.txt — fuzzy hashes
• rabin2-info.txt — radare2 binary summary
• binwalk.txt — embedded artifact scan
• dynamic-analysis.md — CAPE sandbox status (skipped, no Windows guest)
• Terminal: UPX 4.2.2 not-packed test, pefile.py resource enumeration, overlay extraction, xxd tail dump

All static analysis. No dynamic execution was performed.