Unclassified AutoIt Compiled PE32: f0059bee — 932 KB SCRIPT resource, procurement lure

Executive Summary

Single-file AutoIt v3 compiled PE32 (AutoItSC) with a 932 KB encrypted SCRIPT resource in .rsrc — the largest payload observed in this cluster to date. Filename masquerades as a procurement inquiry (INQUIRY_2024-SP0006-B(01)_INQ24-012207.exe). Aug 2024 build. Static-only; no CAPE detonation available. Threat logic is opaque inside the compiled AutoIt bytecode.^[file.txt]^[capa.txt]^[dynamic-analysis.md]

What It Is

Cluster membership: Seventh confirmed sibling of the unclassified-autoit-compiled AutoItSC cluster. Shared fingerprint: single-file PE32, AU3!EA06 header, MSVC 14.x runtime, SCRIPT resource in .rsrc.^[strings.txt:1418]^[strings.txt:3009]

How It Works

The binary is the AutoIt v3 interpreter runtime fused with a compiled .a3x-equivalent script. On execution, the runtime decrypts and interprets the bytecode inside the .rsrc SCRIPT entry (RT_RCDATA, type 0xA).^[pefile.txt:1490–1520] The script itself is opaque; static tools see only the interpreter's C++ runtime imports.

The .rsrc section is oversized at 964 KB raw (virtual size 0xEC09C), of which the SCRIPT blob occupies 932 KB (0xE3364).^[pefile.txt:144]^[pefile.txt:1518] This is significantly larger than prior siblings (previous max: 802 KB in ac2ca060), suggesting either additional plugin modules or expanded C2 logic.

No packing — UPX, Themida, or custom crypter absent. AutoIt's natural bytecode obfuscation serves as the primary evasion layer.^[capa.txt]

No anti-debug in the runtime itself (IsDebuggerPresent is imported but is a standard CRT feature). The script may contain its own sandbox gating; this is not recoverable statically.

Decompiled Behavior

Ghidra / radare2 analysis of the C++ interpreter runtime yields ~2,800 functions of standard AutoItSC boilerplate (GUI message loops, memory management, registry wrappers, PCRE engine, Win32 API thunks). The actual threat logic is inside the compiled AutoIt script bytecode, which Ghidra does not decompile.^[rabin2-info.txt]

Notable runtime functions observed in the symbol table:

• mciSendStringW, waveOutSetVolume — multimedia control (likely used by the script for audio beaconing or UI feedback)^[pefile.txt:328–330]
• WNetAddConnection2W, WNetUseConnectionW — network share mapping^[pefile.txt:362–363]
• CreateProcessAsUserW, LogonUserW — token-based privilege escalation^[pefile.txt:1225–1229]
• VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, OpenProcess — cross-process injection primitives^[pefile.txt:928,1013–1014]

C2 Infrastructure

No C2 URLs, IPs, domains, or hardcoded mutex names recovered statically. The AutoIt script likely resolves C2 at runtime from an encrypted config inside the SCRIPT resource. Marked as runtime-resolved / static-opaque.

Interesting Tidbits

• Largest script in cluster: 932 KB SCRIPT vs 802 KB prior max.^[pefile.txt:1518] The delta (~130 KB) may be additional AutoIt #include modules or expanded string tables.
• Procurement social engineering: Filename format mimics a formal supplier inquiry (SP0006-B(01)_INQ24-012207), typical of B2B spear-phishing.^[metadata.json:4]
• British English locale: VS_VERSIONINFO language code 0x0809 (en-GB), consistent with prior cluster siblings.^[pefile.txt:980]
• Full Win32 API surface: Imports span networking (WSOCK32 + WININET), GUI manipulation (USER32/GDI32), registry, token privilege escalation, clipboard, screenshots, and keylogging — the complete AutoIt malware toolkit.^[pefile.txt:274–410]
• No .NET, no Go, no Rust: Pure C++ interpreter runtime. Avoids the signatures that cluster modern malware families.

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.16.1 (or latest stable) + SciTE editor on Windows 10/11 VM.

Steps:

1. Write a trivial AutoIt script: MsgBox(0, "Test", "Hello").
2. Compile via Tools → Compile Script (x86) with options: UPX = No, Execution Level = asInvoker.
3. Run rabin2 -I repro.exe — should show compiled timestamp, 5 sections, .rsrc containing RT_RCDATA type 0xA named SCRIPT.
4. Run capa repro.exe — should trigger the (internal) autoit file limitation warning.
5. Compare strings repro.exe | grep AU3 — should show AU3!EA06.

Verification: The resulting binary will match the YARA rule below on the SCRIPT resource signature.

Deployable Signatures

YARA Rule

rule autoitsc_singlefile_pe32_script_resource
{
    meta:
        description = "AutoIt v3 single-file compiled PE32 with SCRIPT resource in .rsrc"
        author = "PacketPursuit"
        date = "2026-06-19"
        hash = "f0059beebd2edd77495f1b94c756a6706052c3356aca19cf4807ee780629d15f"
    strings:
        $au3_hdr = "AU3!EA06" ascii
        $autoitsc = ".text$lp00AutoItSC" ascii
        $thirdparty = "This is a third-party compiled AutoIt script." ascii
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections >= 5 and
        pe.section_named(".rsrc") != none and
        pe.sections[pe.section_index(".rsrc")].raw_data_size > 0x10000 and
        pe.resources[0].type == pe.RESOURCE_TYPE_RCDATA and
        for any i in (0..pe.number_of_resources - 1): (
            pe.resources[i].type == pe.RESOURCE_TYPE_RCDATA and
            pe.resources[i].name_string == "SCRIPT"
        ) and
        ($au3_hdr or $autoitsc or $thirdparty)
}

Sigma Rule

title: AutoItSC Single-File PE32 Execution with Network Activity
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        CommandLine|contains:
            - 'INQUIRY_'
            - 'INQ24-'
            - 'Invoice.exe'
            - 'AUG_SOA.exe'
    selection_autoit:
        - Image|endswith: '\AutoIt3.exe'
        - ParentImage|endswith: '\AutoIt3.exe'
        - CommandLine|contains: '.a3x'
    selection_network:
        Initiated: 'true'
        DestinationPort:
            - 80
            - 443
            - 8080
    condition: selection_autoit and selection_network
falsepositives:
    - Legitimate AutoIt automation scripts in enterprise environments
level: medium

IOC List

Behavioral Fingerprint

This binary is an AutoIt v3 single-file compiled PE32 (AutoItSC) with a large encrypted SCRIPT resource in .rsrc (RT_RCDATA). On launch, the interpreter runtime decrypts the bytecode and executes it. The interpreter imports the full Win32 API surface including WSOCK32, WININET, ADVAPI32 registry APIs, and USER32/GDI32 for GUI/clipboard/screenshot operations. Network activity, if observed, originates from the AutoIt interpreter process and connects to HTTP/FTP or raw TCP endpoints resolved at runtime by the script. No hardcoded C2 strings are present in the PE body.

Detection Signatures

References

• Artifact ID: 0221611e-a1f7-4b29-a6f8-f201c79124f2 (OpenCTI)
• Source: MalwareBazaar / OpenCTI malware-bazaar connector
• Related entity: unclassified-autoit-compiled
• Related concept: autoit-compiled-script-dropper

Provenance

• file.txt — file(1) output
• exiftool.json — ExifTool PE metadata
• pefile.txt — pefile Python library full dump
• rabin2-info.txt — radare2 binary header summary
• strings.txt — ASCII/Unicode strings extraction
• capa.txt — Mandiant flare-capa capability detection
• floss.txt — FireEye flare-floss (failed due to AutoIt limitation)
• binwalk.txt — embedded artifact scan
• dynamic-analysis.md — CAPE sandbox status (skipped)
• yara.txt — local YARA matches (PE_File_Generic, Suspicious_Wininet_Imports)