Unclassified AutoIt Compiled PE32: f3a48a8c — PO lure, 313 KB encrypted script, PCRE runtime

Executive Summary

Purchase-order-themed AutoItSC single-file PE32 (PO20240627-001.exe), compiled 27 June 2024. Tenth confirmed sibling of the unclassified-autoit-compiled cluster. Carries a 313 KB encrypted compiled script in .rsrc (RT_RCDATA SCRIPT, AU3!EA06 header) — the threat logic is entirely inside this script, inaccessible to static string extraction. Runtime imports standard AutoIt library set (WinInet/WinSock/GDI/ADVAPI32/Shell32). PCRE regex library strings in .text indicate embedded Perl-compatible pattern engine, suggesting script-side data parsing or credential harvesting. No C2 strings recovered. Static-only analysis; no CAPE detonation. ^[file.txt] ^[pefile.txt]

What It Is

Cluster sibling to unclassified-autoit-compiled — see that entity page for shared build-stack analysis. This sample's distinguishing traits vs siblings:

• Largest script in non-overlay placement: 313 KB in .rsrc RT_RCDATA (only f0059bee at 932 KB is larger, but both use .rsrc placement; ff84806a and f346b7e9 use overlay). ^[pefile.txt:152]
• PCRE regex runtime present: Full PCRE error-message table and Unicode script-name table in .text (e.g. "this version of PCRE is compiled without UTF support", "Inscriptional_Pahlavi", "Inscriptional_Parthian"), confirming the AutoIt interpreter was built with PCRE linked. Same trait as sibling f2be9e06. ^[strings.txt:625] ^[strings.txt:718]
• Purchase-order lure: Filename PO20240627-001.exe matches procurement/B2B social-engineering theme seen in siblings f0059bee, f2be9e06, f346b7e9. ^[metadata.json]

How It Works

The binary is the AutoIt v3 single-file compiler (AutoItSC) output: a PE32 that embeds both the AutoIt interpreter runtime and the compiled/encrypted script in one executable. At launch the runtime decrypts and interprets the script, which then performs the malicious actions. ^[autoit-compiled-script-dropper]

Script storage: .rsrc section, resource Type 10 (RT_RCDATA), Name SCRIPT (not numeric ID), 313,472 bytes. Header at offset 0x4c880 inside .rsrc reads AU3!EA06 — the AutoIt compiled-script magic. ^[r2:sections] ^[binwalk.txt] ^[strings.txt:1299]

Import surface (all from the AutoIt runtime, not the script):

• Network: WinInet (HTTP/FTP), WinSock (raw TCP/UDP), ICMP echo via IPHLPAPI.dll ^[r2:imports]
• File/registry: CreateFileW, RegSetValueExW, RegCreateKeyExW, ShellExecuteW, SHBrowseForFolderW ^[r2:imports]
• Privilege/token: AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, CreateProcessAsUserW ^[r2:imports]
• Process: CreateProcessW, CreateToolhelp32Snapshot, Process32FirstW/NextW, VirtualAllocEx, WriteProcessMemory ^[r2:imports]
• Input/capture: GetAsyncKeyState, SetClipboardData, GetClipboardData, BlockInput, mouse_event, keybd_event, SendInput ^[r2:imports]
• GDI/screenshot: StretchBlt, GetDIBits, CreateCompatibleBitmap, BitBlt-adjacent surface ^[r2:imports]

No script-level strings (URLs, mutexes, registry keys, file paths) are visible — the compiled script is encrypted bytecode. Decompilation would require MyAut2Exe / Exe2Aut or AutoIt decompiler tools. ^[capa.txt]

Decompiled Behavior

Radare2 analysis level 3 recovered 2,645 functions — all belonging to the AutoIt interpreter runtime and its statically-linked C runtime (MSVCRT/GDI/USER32 wrappers). The entry point (0x2800a) is the standard AutoItSC bootstrap; no meaningful decompilation of the script payload is possible without AutoIt-specific tools. ^[r2:analyze]

Notable runtime functions (from symbol table, not script logic):

• IsDebuggerPresent imported (standard Windows API, not an active anti-debug loop). ^[r2:imports]
• OutputDebugStringW present — could be used for conditional logging or as a trivial anti-debug trigger if a debugger is attached. ^[r2:imports]
• No process-hollowing, no APC injection, no PEB-walking API resolution — all imports are resolved normally via IAT.

C2 Infrastructure

None recoverable statically. The compiled AutoIt script encrypts all network configuration. The runtime surface (WinInet + WinSock) tells us the script can speak HTTP, FTP, and raw TCP/UDP, but the actual C2 endpoints, beacon intervals, and protocol are inside the encrypted script payload. No hardcoded domains, IPs, URLs, or mutexes observed. ^[strings.txt] ^[floss.txt] (floss failed due to AutoIt limitation) ^[capa.txt]

Interesting Tidbits

• PE timestamp vs actual activity: Jun 2024 build, but filename references PO20240627 — the purchase order date matches the PE timestamp exactly, suggesting the attacker built the binary the same day the lure document was themed. ^[pefile.txt:34] ^[metadata.json]
• PCRE inclusion implies data parsing: The PCRE library is not needed for basic AutoIt GUI automation. Its presence (along with full Unicode script-name tables) suggests the script performs regex-based data extraction — credential harvesting, form parsing, or log scraping. Same pattern in sibling f2be9e06. ^[strings.txt:625]
• Full ADVAPI32 token surface: CreateProcessAsUserW, CreateProcessWithLogonW, LogonUserW, and DuplicateTokenEx are all imported — the script has the capability to spawn processes under different credentials or elevate via token manipulation. ^[r2:imports]
• MPR.dll present: WNetUseConnectionW, WNetAddConnection2W — network-share mapping primitives available to the script for lateral movement or staging payloads on SMB shares. ^[r2:imports]
• No UPX, no custom packer: Plain AutoItSC PE32 with standard MSVC C++ runtime. Entropy on .text is 6.68 (normal for compiled C++), .rsrc is 7.96 (expected for encrypted script payload). ^[pefile.txt:92] ^[pefile.txt:152]
• UserEnv.dll: LoadUserProfileW, CreateEnvironmentBlock — profile-loading primitives that could be used to impersonate or load another user's hive (e.g., for credential theft from roaming profiles). ^[r2:imports]

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.x + SciTE4AutoIt + Aut2Exe.exe (single-file compiler).

Steps:

1. Install AutoIt v3 from autoitscript.com.
2. Write a .au3 script that uses InetRead, RegWrite, FileWrite, and DllCall.
3. Compile with Aut2Exe.exe /in script.au3 /out PO_lure.exe.
4. Verify with file PO_lure.exe → should show PE32 executable (GUI) Intel 80386.
5. Check rabin2 -i PO_lure.exe for WinInet/WinSock/GDI imports.

Verification: Run capa PO_lure.exe — should trigger the autoit file limitation warning and show the same import surface.

What you'll learn: How a legitimate automation framework becomes a malware vehicle through compiled-script encryption, and why standard string extraction yields nothing.

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_PO_Lure {
    meta:
        description = "AutoIt single-file compiled PE32 with purchase-order lure filename"
        author = "PacketPursuit"
        date = "2026-06-20"
        hash = "f3a48a8c0394a72abf464dcf8b77420f0c5cba528c71bdc017dd692db031d69b"
    strings:
        $au3_hdr = "AU3!EA06" ascii
        $autoit_str = "This is a third-party compiled AutoIt script." ascii wide
        $pcre_utf8 = "this version of PCRE is compiled without UTF support" ascii
        $po_filename = /PO[_\-#]?[0-9]{4,8}/i ascii wide
    condition:
        uint16(0) == 0x5a4d and
        pe.number_of_sections == 5 and
        pe.imports("WININET.dll") and
        pe.imports("WSOCK32.dll") and
        $au3_hdr and
        $autoit_str and
        filesize < 3MB
}

Sigma Rule (Behavioral Hunt)

title: AutoIt Compiled Script Execution with Network Activity
logsource:
    category: process_creation
    product: windows
detection:
    selection_autoit:
        - Image|endswith: '\AutoIt3.exe'
        - CommandLine|contains: '.a3x'
        - Description|contains: 'AutoIt'
    selection_network:
        - Initiated: 'true'
          DestinationPort:
            - 80
            - 443
            - 8080
    selection_parent:
        ParentImage|endswith:
            - '\winword.exe'
            - '\excel.exe'
            - '\outlook.exe'
            - '\chrome.exe'
            - '\firefox.exe'
    condition: selection_autoit and (selection_network or selection_parent)
falsepositives:
    - Legitimate AutoIt automation scripts in enterprise environments
level: medium

IOC List

Behavioral Fingerprint

This binary is a single-file AutoItSC PE32 with a large encrypted script in .rsrc (RT_RCDATA, 200 KB–1 MB). It imports the full AutoIt runtime surface: WinInet for HTTP/FTP, WinSock for raw sockets, ADVAPI32 for registry writes and token manipulation, GDI32 for screenshots, and USER32 for input capture. The PCRE regex library is statically linked. No hardcoded C2. At runtime the interpreter decrypts the script and executes it; the script may spawn processes, write to registry Run keys, map network shares, or beacon to remote hosts. Detection value lies in the parent-child relationship (unusual launcher → AutoIt3.exe or single-file PE with .rsrc SCRIPT resource) and the network activity from a GUI-subsystem PE with no legitimate software publisher.

Detection Signatures

References

• Artifact ID: 9f42bf68-1698-48e2-9e8e-342176b1af1c (OpenCTI) ^[metadata.json]
• Source: MalwareBazaar via OpenCTI urlhaus-recent-payloads connector
• Cluster page: unclassified-autoit-compiled
• Concept page: autoit-compiled-script-dropper
• Sibling with PCRE trait: f2be9e06 (PO_#86637.exe) ^[/intel/analyses/f2be9e06fff932ac45101a0b28b07379fad8b868697b2bd95af141a01afa5f16.html]

Provenance

Analysis conducted 2026-06-20 using triage artefacts from wiki/wiki/raw/analyses/f3a48a8c0394a72abf464dcf8b77420f0c5cba528c71bdc017dd692db031d69b/: file.txt (file), exiftool.json (exiftool 12.76), pefile.txt (pefile), strings.txt (strings), floss.txt (floss — failed with AutoIt limitation), capa.txt (capa — AutoIt limitation warning), binwalk.txt (binwalk), rabin2-info.txt (radare2 5.x), metadata.json (OpenCTI), triage.json (triage-fast). Radare2 analysis level 3 on the raw binary via MCP (mcp_radare2_analyze, mcp_radare2_list_imports, mcp_radare2_list_sections). No CAPE detonation available (no Windows guest). Script resource verified via Python pefile and xxd.