unclassified-autoit-compiled: f346b7e9 — 659 KB overlay-script PO lure, Jan 2012 AutoItSC v3.3.8.1

Executive Summary

Ninth confirmed sibling of the unclassified-autoit-compiled AutoItSC single-file PE32 cluster. Same AutoIt v3.3.8.1 interpreter runtime (MSVC linker 10.0, Jan 2012 PE timestamp), but the compiled script lives in the file overlay rather than the .rsrc section — a placement variant shared with only ff84806a in this cluster. Filename PO-A1702108.exe follows the procurement/purchase-order lure theme seen in siblings f0059bee and f2be9e06. Static-only; no CAPE Windows guest available.

What It Is

Cluster membership confirmed by ssdeep prefix match (3:mSc3D0as0pVPAt0L1IDTCHlBz8HEXCWqRoK...) against all eight prior siblings. ^[sample f346b7e9/ssdeep.txt]

How It Works

This is a single-file output of the AutoIt v3 single-file compiler (AutoItSC). The PE bundles the AutoIt interpreter runtime (the .text, .rdata, .data sections) with a compiled AutoIt script payload. At launch, the interpreter reads and executes the compiled script bytecode.

Key delta from most cluster siblings: the compiled script is stored in the file overlay after the last PE section (.rsrc), not as an RT_RCDATA resource inside .rsrc. The only other sibling in this cluster showing overlay placement is ff84806a (694 KB script). All other siblings (ac2ca060, 2c6133ca, 6cc26f7c, 1d0834e7, ef71e0f6, f0059bee, f2be9e06) store the script as a .rsrc resource.

The PE imports are the standard AutoIt v3 runtime suite: ^[pefile.txt]

• Network: WSOCK32.dll (sockets, DNS), WININET.dll (HTTP, FTP, URL cracking)
• UI / capture: USER32.dll (clipboard, keyboard input, screen metrics, window enumeration), GDI32.dll (bitmap, DC, screenshot primitives)
• Registry / persistence: ADVAPI32.dll (RegSetValueExW, RegCreateKeyExW, token manipulation, service control)
• Process / injection: KERNEL32.dll (CreateProcessW, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, OpenProcess, CreateThread)
• System control: SetSystemPowerState (shutdown/suspend/hibernate), BlockInput (disable user input)
• Privilege escalation: OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW

The compiled script itself is opaque to static string extraction. No C2 URLs, mutex names, or hardcoded paths were recovered from the PE. The floss.txt run failed with a command-line syntax error; even when run correctly, FLOSS would not decode AutoIt compiled bytecode.

Decompiled Behavior

Ghidra analysis is queued; radare2 analysis completed with 2412 functions identified. ^[r2:analysis] However, decompiling the AutoIt interpreter runtime yields only the generic AutoIt engine — the malicious logic is inside the 659 KB compiled script payload, which is encrypted/compiled AutoIt bytecode. Reverse-engineering the interpreter itself is not productive for this sample; the threat actor's code is in the script.

For script-level analysis, MyAut2Exe or Exe2Aut would be required to extract and decompile the .a3x-equivalent bytecode from the AU3!EA06 overlay.

C2 Infrastructure

No C2 strings recovered statically. The compiled script payload is opaque. Runtime C2 would be established by the AutoIt script using the imported WinInet or WinSock APIs. Based on cluster siblings' behavior, expect HTTP/HTTPS beaconing or raw TCP/UDP C2.

Interesting Tidbits

• Overlay vs .rsrc placement: The script header AU3!EA06 appears at offset 0x9E810 (in the overlay) and again at the very end of file (offset 0x14343B), which is simply the tail of the script data reaching EOF. This is distinct from siblings that use a dedicated RT_RCDATA resource ID SCRIPT. ^[sample f346b7e9/binwalk.txt]
• PE timestamp is interpreter build date, not malware compilation date: Jan 29 2012 is the build date of AutoIt v3.3.8.1. The actual script could have been compiled years later. This is a common pitfall when dating AutoIt malware.
• Procurement lure theme: PO-A1702108.exe (Purchase Order #A1702108) continues the business-document lure pattern seen in f0059bee (INQUIRY_2024-SP0006-B(01)_INQ24-012207.exe) and f2be9e06 (PO_#86637.exe).
• PCRE library strings present: Full PCRE error-message table and Unicode script-name table (lines 361–515 of strings.txt) — same as sibling f2be9e06, suggesting script-side regex pattern harvesting. ^[strings.txt:361]
• No Authenticode, no PDB, no debug directory: Stripped production build of the AutoIt interpreter.

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 (or latest) on Windows XP–10.

1. Install AutoIt from autoitscript.com.
2. Write a .au3 script that uses InetRead, RegWrite, FileWrite, DllCall to user32.dll.
3. Compile with Aut2Exe (right-click → Compile Script) or AutoItSC.bin directly.
4. Output is a single PE32 with the interpreter + compiled script.
5. Verify: strings <output.exe> | grep -i autoit should show the AutoIt version string and AU3!EA06.
6. To extract the script: use Resource Hacker or 7z to inspect .rsrc; if the script is in overlay, carve from the AU3!EA06 header to EOF.

Verification step: Compile a simple AutoIt script and run capa on it — should hit the same autoit file limitation warning as this sample.

Deployable Signatures

YARA rule

rule AutoItSC_SingleFile_Cluster : autoit loader {
    meta:
        description = "Detects AutoIt v3 single-file compiled PE (AutoItSC) cluster — overlay or .rsrc script storage"
        author = "pp-hermes"
        date = "2026-06-20"
        hash1 = "f346b7e98f063bedfc73d0058393cee6cd7d2089831a9176841567b3cc4acb8a"
        reference = "/intel/analyses/f346b7e98f063bedfc73d0058393cee6cd7d2089831a9176841567b3cc4acb8a.html"
    strings:
        $au3_hdr = "AU3!EA06" ascii
        $autoit_ver = "CompiledScript: AutoIt v3 Script:" ascii wide
        $autoit_err = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support." ascii wide
        $au3_plugin = "AU3_GetPluginDetails" ascii
        $pcre_err1 = "numbers out of order in {} quantifier" ascii
        $pcre_err2 = "failed to get memory" ascii
        $pcre_err3 = "internal error: code overflow" ascii
    condition:
        uint16(0) == 0x5A4D and
        filesize > 512KB and
        (
            ($au3_hdr and ($autoit_ver or $autoit_err)) or
            ($au3_plugin and 2 of ($pcre_err*))
        ) and
        pe.imports("WSOCK32.dll", "socket") and
        pe.imports("WININET.dll", "InternetOpenW")
}

Sigma rule

title: AutoItSC Single-File PE Execution - Network Activity
description: Detects AutoItSC-compiled PE32 making network connections shortly after launch
logsource:
    product: windows
    category: network_connection
detection:
    selection:
        Image|endswith:
            - '.exe'
        Initiated: 'true'
    filter_autoit:
        - pe.description|contains: 'AutoIt v3'
        - pe.company|contains: 'AutoIt'
    filter_imports:
        - ImageLoaded:
            - 'WSOCK32.dll'
            - 'WININET.dll'
    condition: selection and filter_autoit and filter_imports
falsepositives:
    - Legitimate AutoIt scripts compiled to EXE for administrative automation
level: medium

IOC list

Behavioral fingerprint

This binary is a single-file AutoItSC PE32. On execution, it loads the standard AutoIt interpreter runtime from its .text section, locates the compiled script payload (in this sample, in the file overlay starting at offset 0x9E810), decrypts/validates the AU3!EA06 header, and executes the bytecode. The script has access to the full Win32 API surface exposed by the AutoIt runtime: HTTP/FTP via WinInet, raw sockets via WinSock, registry writes via ADVAPI32, screenshot/clipboard capture via GDI32/USER32, process injection via VirtualAllocEx/WriteProcessMemory, and privilege escalation via AdjustTokenPrivileges. No network IOCs are visible statically because they are embedded in the encrypted compiled script.

Detection Signatures

capa → ATT&CK mapping

CAPA declined deep analysis with the autoit file limitation warning. ^[capa.txt] ATT&CK mapping is inferred from the AutoIt runtime import table:

References

• Artifact ID: 9f84582a-f29f-48ef-b99d-7990d94f2c15
• Source: MalwareBazaar / OpenCTI
• Related wiki pages: unclassified-autoit-compiled, autoit-compiled-script-dropper, asgardprotector

Provenance

Static analysis performed on pp-hermes (Lab1BU, <lan>). File type by file, PE parsing by pefile, strings by strings -n 6, radare2 v5.9.9 for binary structure and entry-point analysis, ssdeep v2.14.1 for fuzzy hashing, tlsh v4.12.0 for locality-sensitive hashing. CAPA v8.0.0 flagged AutoIt limitation and declined further analysis. FLOSS failed due to command-line syntax error in the triage wrapper. No CAPE detonation — no Windows guest available for PE32 platform.