unclassified-autoit-compiled: f2be9e06 — PO_#86637.exe, 417 KB SCRIPT, PCRE regex library

Executive Summary

Eighth confirmed sibling of the AutoItSC single-file compiled PE32 cluster. Filename PO_#86637.exe continues the procurement/purchase-order lure theme. A 417 KB compiled AutoIt script (RT_RCDATA) sits in .rsrc with AU3!EA06 header markers. Notable delta vs prior siblings: prominent embedded PCRE regex library (error strings, Unicode property names) suggesting script-side pattern harvesting. Static-only — CAPE skipped (no Windows guest). Unsigned, MSVC 14.16, Sep 2024 build.

What It Is

This sample belongs to the unclassified-autoit-compiled cluster. See that entity page for shared build-stack fingerprint, TTPs, and the seven prior siblings.

How It Works

The binary is a standard AutoIt v3 single-file compiler (AutoItSC) output: the C++ interpreter runtime and a compiled .a3x-equivalent bytecode payload are fused into one PE. At entry-point (0x420577), the runtime initialises the AutoIt engine, locates the SCRIPT resource via LoadResource/LockResource/SizeofResource (all imported ^[pefile.txt:493-495]), decrypts/decompresses the bytecode, and executes it within the interpreter loop. The actual threat logic is entirely inside the compiled script; static analysis of the outer PE only reveals the AutoIt runtime surface.

Notable delta — PCRE regex library. Strings contain ~100 lines of PCRE error messages (e.g. numbers out of order in {} quantifier, range out of order in character class, regular expression is too large) and the full Unicode script-name table (Arabic, Armenian, Avestan, Balinese, Bengali, Bopomofo, Brahmi, Braille, Buginese, Canadian_Aboriginal, Carian, Caucasian_Albanian, Chakma, Cherokee, Common, Coptic, Cuneiform, Cypriot, Cyrillic, Deseret, Devanagari, Duployan, Egyptian_Hieroglyphs, Elbasan, Ethiopic, Georgian, Glagolitic, Gothic, Grantha, Gujarati, Gurmukhi, Hangul, Hanunoo, Hebrew, Hiragana, Imperial_Aramaic, Inscriptional_Pahlavi, Inscriptional_Parthian, Javanese, Kaithi, Kannada, Katakana, Kayah_Li, Kharoshthi, Khojki, Khudawadi, Lepcha, Linear_A, Linear_B, Lycian, Lydian, Mahajani, Malayalam, Mandaic, Manichaean, Meetei_Mayek, Mende_Kikakui, Meroitic_Cursive, Meroitic_Hieroglyphs, Mongolian, Myanmar, Nabataean, New_Tai_Lue, Ol_Chiki, Old_Italic, Old_North_Arabian, Old_Permic, Old_Persian, Old_South_Arabian, Old_Turkic, Osmanya, Pahawh_Hmong, Palmyrene, Pau_Cin_Hau, Phags_Pa, Phoenician, Psalter_Pahlavi, Rejang, Samaritan, Saurashtra, Sharada, Shavian, Siddham, Sinhala, Sora_Sompeng, Sundanese, Syloti_Nagri, Syriac, Tagalog, Tagbanwa, Tai_Le, Tai_Tham, Tai_Viet, Telugu, Thaana, Tibetan, Tifinagh, Tirhuta, Ugaritic, Warang_Citi) ^[strings.txt:569-760]. This is the first sibling in the cluster where PCRE artefacts are this prominent; prior siblings show only the AutoIt runtime and standard Windows API strings. The regex engine is likely used by the script for data-harvesting (credential/file-pattern matching).

Import table is the standard AutoItSC runtime surface: WSOCK32 (sockets), WININET (HTTP/FTP), WINMM (audio/timer), COMCTL32 (common controls), MPR (mapped drives), PSAPI (process memory), IPHLPAPI (ICMP ping), USERENV (user profiles), UxTheme (theming), KERNEL32 (process/file/memory), USER32 (windowing/GUI/clipboard/keylogging), GDI32 (screenshots), COMDLG32 (file dialogs), ADVAPI32 (registry/token/security), SHELL32 (shell ops), ole32/OLEAUT32 (COM). ^[pefile.txt:274-500] No packed/encrypted imports; all names are plaintext.

Decompiled Behavior

Static decompilation of the AutoItSC runtime entry (entry0 at 0x420577) via radare2 shows the classic MSVC CRT initialisation sequence: __security_init_cookie, SEH frame setup, then a call to main() at 0x401c60 ^[r2:entry0]. The main() function is a thin wrapper that checks a global flag (byte [0x4d13bd]) and immediately returns — the actual script execution is dispatched through AutoIt interpreter callbacks registered earlier in CRT initialisation. ^[r2:main]

The outer PE does not exhibit anti-debug, anti-VM, or control-flow obfuscation. The only "obfuscation" is the compiled AutoIt bytecode itself, which requires the AutoIt decompiler (MyAut2Exe / Exe2Aut) or dynamic instrumentation to recover.

C2 Infrastructure

No hardcoded C2 strings recovered from static extraction. The AutoIt script logic (417 KB of compiled bytecode) is opaque without decompilation. Based on the import table and cluster history, expected C2 vectors are:

• HTTP/HTTPS via InternetOpenW → InternetConnectW → HttpOpenRequestW → HttpSendRequestW ^[pefile.txt:373-381]
• Raw TCP via WSOCK32.dll (socket, connect, send, recv) ^[pefile.txt:284-306]
• FTP via FtpOpenFileW, InternetOpenUrlW ^[pefile.txt:382-384]

Explicitly unknown: script-level C2 URLs, mutex names, registry keys, file paths — all live inside the encrypted/compiled bytecode.

Interesting Tidbits

• Procurement lure theme. PO_#86637.exe matches the B2B purchase-order naming of sibling f0059bee (INQUIRY_2024-SP0006-B(01)_INQ24-012207.exe, Aug 2024). Both use hyphenated alphanumeric reference codes typical of enterprise procurement systems. ^[metadata.json]
• Mid-size script. At 417 KB, this sample sits between the cluster extremes: smallest is ef71e0f6 (186 KB, "Public_Holiday_Notice"), largest is f0059bee (932 KB, procurement inquiry). ^[entities/unclassified-autoit-compiled.md]
• PCRE library prominence. The ~100 lines of PCRE error strings and Unicode property names are the most extensive regex-library exposure seen in any sibling. Prior siblings (ac2ca060, 2c6133ca, 6cc26f7c, 1d0834e7, ef71e0f6, f0059bee, ff84806a) do not show this surface. This suggests the script contains heavy regex-based data extraction (file matching, credential scraping, or browser-profile parsing).
• No UPX. Unlike sibling 6cc26f7c, this sample is a plain (non-packed) PE32. The .text entropy is 6.67 — consistent with compiled C++, not packed. ^[pefile.txt:92]
• Version info is hollow. VS_VERSIONINFO exists but contains only LangID 0809 (English British) and Translation 0x0809 0x04b0; no CompanyName, FileDescription, or ProductName. ^[pefile.txt:250-272]
• YARA matches. PE_File_Generic and Suspicious_Wininet_Imports. ^[yara.txt]

How To Mess With It (Homelab Replication)

1. Download AutoIt v3 from https://www.autoitscript.com/site/autoit/downloads/ (current stable ~v3.3.16.1).
2. Write a .au3 script that uses InetRead, TCPConnect, RegWrite, FileInstall, and WinHttpRequest.
3. Compile with Aut2Exe.exe (single-file output, x86, GUI subsystem).
4. Verify PE sections: .text, .rdata, .data, .rsrc, .reloc.
5. Verify .rsrc contains RT_RCDATA type=10 with AU3!EA06 header.
6. Run capa on the output — expect AutoIt limitation warning, same as this sample.
7. Run strings — expect AutoIt function names, PCRE strings (if your script uses StringRegExp), and standard Windows API imports.

What you learn: how compiled scripting languages blur the line between "benign automation" and "malware"; why bytecode extraction is the real battleground for AutoIt samples.

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PE32_ProcurementLure : malware family_unclassified_autoit_compiled {
    meta:
        description = "AutoIt v3 single-file compiled PE32 with procurement/purchase-order lure and large SCRIPT resource"
        author = "PacketPursuit"
        date = "2026-06-19"
        reference = "/intel/analyses/f2be9e06fff932ac45101a0b28b07379fad8b868697b2bd95af141a01afa5f16.html"
        hash = "f2be9e06fff932ac45101a0b28b07379fad8b868697b2bd95af141a01afa5f16"
    strings:
        $autoit_sc = ".text$lp00AutoItSC" ascii
        $au3_header = "AU3!EA06" ascii
        $third_party = "This is a third-party compiled AutoIt script." ascii
        $autoit_v3 = "AutoIt v3" ascii
        $wininet1 = "InternetOpenW" ascii
        $wininet2 = "HttpOpenRequestW" ascii
        $wsock = "WSOCK32.dll" ascii
        $pcre_err1 = "numbers out of order in {} quantifier" ascii
        $pcre_err2 = "range out of order in character class" ascii
        $pcre_unicode = "Egyptian_Hieroglyphs" ascii
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C) + 0x18) == 0x010B and          // PE32
        filesize < 3MB and
        3 of ($autoit_sc, $au3_header, $third_party, $autoit_v3) and
        any of ($wininet*) and
        $wsock and
        // Procurement lure filename heuristic
        ( filename matches /PO[_-]?[0-9]{3,6}/i or
          filename matches /INQUIRY[_-]?[0-9]{4}/i or
          filename matches /Invoice/i or
          filename matches /Order/i )
}

Behavioral Hunt Query (Sigma-like)

Process-creation rule targeting the AutoItSC runtime child behaviors:

title: AutoItSC Compiled Script Execution with Network/Registry Activity
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: '\PO_#86637.exe'
    # OR broader: any PE with AutoItSC indicators
  selection_child_network:
    CommandLine|contains:
      - 'powershell'
      - 'cmd.exe'
      - 'schtasks'
      - 'reg.exe'
  selection_child_registry:
    EventID: 4657  # Audit registry modification
    ObjectName|contains:
      - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'
  selection_file_drop:
    TargetFilename|contains:
      - '\\AppData\\Roaming\\'
      - '\\Temp\\'
  condition: selection_parent and (selection_child_network or selection_child_registry or selection_file_drop)
falsepositives:
  - Legitimate AutoIt automation tools (rare in enterprise)
level: medium

IOC List

Behavioral Fingerprint Statement

This binary is a single-file AutoIt v3 compiled PE32 (AutoItSC) with a large RT_RCDATA resource (>400 KB) containing compiled AutoIt bytecode. It presents as a procurement/purchase-order document (PO_#86637.exe). The outer PE imports WinInet (HTTP/FTP), WinSock (raw TCP/UDP), GDI32 (screenshots), USER32 (clipboard/keylogging), and ADVAPI32 (registry/token manipulation). The embedded script likely uses PCRE regex for data harvesting. No anti-debug or VM checks in the outer PE. Execution chain: AutoItSC runtime → LoadResource → decrypt/decompress bytecode → interpreter loop. Network C2 and persistence mechanisms are script-level and not statically recoverable without AutoIt decompilation.

Detection Signatures

References

• Artifact ID: 408e86e4-d784-40ba-8642-51c6e268d361 ^[metadata.json]
• MalwareBazaar / OpenCTI source: malware-bazaar connector
• AutoIt v3: https://www.autoitscript.com/
• MyAut2Exe decompiler: https://github.com/x0r19x91/Exe2Aut (unofficial)
• unclassified-autoit-compiled — cluster entity page (8 siblings)
• autoit-compiled-script-dropper — concept page for AutoIt deployment patterns

Provenance

Analysis generated from:

• wiki/wiki/raw/analyses/f2be9e06fff932ac45101a0b28b07379fad8b868697b2bd95af141a01afa5f16/{file.txt, exiftool.json, pefile.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, metadata.json, triage.json, floss.txt, capa.txt, binwalk.txt, rabin2-info.txt}
• radare2 analysis (level 3, 2892 functions) of entry-point 0x420577 and main() at 0x401c60
• Python pefile resource enumeration (RT_RCDATA, 427,079 bytes)
• Manual string review of full 2,852-line strings.txt output
• No dynamic analysis (CAPE skipped — no Windows guest available)