unclassified-autoit-compiled: f618a861 — DHL AWB tracking lure, 237 KB encrypted SCRIPT resource

Executive Summary

A single-file AutoIt v3 compiled PE32 masquerading as a DHL airway-bill tracking document (DHL_AWB_TRACKING_DETAILS.exe). The interpreter runtime and a 237 KB encrypted compiled script (AU3!EA06 header) are fused into one binary. capa identifies the AutoIt limitation immediately and aborts deep capability extraction. Static analysis reveals the standard AutoItSC import surface (WinInet, WinSock, GDI32, ADVAPI32) and full PCRE regex library bloat. No hardcoded C2 strings or persistence mechanisms are visible — all threat logic is inside the encrypted script resource. This is the fourteenth confirmed sibling of the unclassified-autoit-compiled cluster.

What It Is

• SHA-256: f618a8619ab45629df06d80a6d5fec78962a679dbaaca29cf51cf9261973486f
• Filename: DHL_AWB_TRACKING_DETAILS.exe — logistics/shipping social-engineering lure^[metadata.json]
• File type: PE32 executable (GUI) Intel 80386, 5 sections^[file.txt]
• Size: 1,108,480 bytes (1.08 MB)
• Compilation timestamp: Tue Jul 9 06:56:48 2024 UTC^[exiftool.json]
• Linker: Microsoft linker 12.0 (VS 2013 toolchain)^[pefile.txt]
• Subsystem: Windows GUI, ASLR-aware, large-address-aware^[pefile.txt]
• Signing: Unsigned (no Authenticode)^[rabin2-info.txt]
• PDB: None
• Script resource: RT_RCDATA type 0xA, name SCRIPT, size 0x3B4D6 (242,902 bytes ≈ 237 KB) at offset 0xD07B8^[pefile.txt:1486-1514]
• Script header: AU3!EA06 visible in .rsrc and at strings offset 1381 and 1823^[strings.txt:1381]^[strings.txt:1823]
• AutoIt runtime version: v3.3.8.1 inferred from AU3!EA06 magic and error-string profile^[strings.txt:1480-1485]

How It Works

At load, the AutoItSC runtime initializes its interpreter heap, locates the SCRIPT resource in .rsrc, decrypts/decompresses the compiled bytecode (AU3!EA06 format), and begins executing the AutoIt script in-process. The script itself is not recoverable without the AutoIt decompiler (MyAut2Exe) or the original source. All malicious behavior — C2 URLs, persistence commands, file staging, keylogging — lives inside that encrypted script. The runtime merely provides the API surface the script calls.

The import table is therefore the only static window into capability:

• Network: WinInet (HTTP/FTP/URL cracking) + WSOCK32 (raw TCP/UDP, socket creation, DNS resolution)^[pefile.txt:373-386]^[pefile.txt:284-306]
• GUI / Collection: GDI32 (screenshot primitives), USER32 (clipboard access, window enumeration, GetAsyncKeyState for keylogging)^[pefile.txt:985-1144]
• Privilege / Persistence: ADVAPI32 (token manipulation, registry read/write, CreateProcessAsUserW, InitiateSystemShutdownExW)^[pefile.txt:1184-1217]
• Process / Injection: KERNEL32 (VirtualAllocEx, WriteProcessMemory, OpenProcess, CreateProcessW, CreateThread)^[pefile.txt:441-498]
• System Recon: IPHLPAPI (IcmpSendEcho), PSAPI (GetProcessMemoryInfo), USERENV (LoadUserProfileW), VERSION (VerQueryValueW)^[pefile.txt:396-421]

This is the identical runtime surface observed across all thirteen prior siblings in the cluster.^[entities/unclassified-autoit-compiled.md]

Decompiled Behavior

Ghidra / radare2 decompilation of the AutoItSC interpreter runtime was not pursued. capa flags the binary as an AutoIt-compiled script and aborts capability extraction because the actual threat logic is in the encrypted script resource, not in the PE's .text section.^[capa.txt:5-15] The runtime is the well-known AutoItSC v3.3.8.1 C++ interpreter; decompiling it adds no family-specific insight beyond what the import table and resource layout already reveal. Cluster behavior is documented at unclassified-autoit-compiled.

C2 Infrastructure

C2 obfuscated / runtime-resolved. No hardcoded IP addresses, domains, URLs, mutex names, or registry keys are visible in the PE strings or imports. All network indicators are expected to be embedded inside the encrypted SCRIPT resource and decoded at runtime by the AutoIt interpreter.^[strings.txt — no C2 URLs recovered]

Interesting Tidbits

• Logistics lure theme: The filename DHL_AWB_TRACKING_DETAILS.exe targets shipping/clerical workers — a recurring theme in this cluster (previous lures: HAWB, airway bills, purchase orders, invoices, public-holiday notices, FDA regulatory docs).^[entities/unclassified-autoit-compiled.md]
• Mid-range script size: At 237 KB, the script payload is neither the smallest (186 KB) nor the largest (932 KB) in the cluster. The size spread suggests modular script reuse: a common runtime + varying script modules.^[entities/unclassified-autoit-compiled.md]
• Four-icon resource suite: RT_GROUP_ICON contains four icon entries (IDs 0x63, 0xA2, 0xA4, 0xA9), all UK-English localized. The primary icon is a 48×48 PNG-style DHL-branded document icon — consistent with the masquerade.^[pefile.txt:1518-1609]
• Empty VS_VERSIONINFO: The version block is structurally present (220 bytes) but contains no meaningful strings — FileVersion, ProductVersion, and CompanyName are all null or filler.^[pefile.txt:231-273]
• PCRE regex bloat: The full PCRE error-message table (80+ Unicode script names, 70+ regex error strings) is present in .rdata, confirming the runtime links pcre.dll or statically embeds it. This trait is shared with siblings f2be9e06, f3a48a8c, f51bc678, f527ce01, and e5647a2d.^[strings.txt:592-782]
• No packing or anti-debug: The PE is plain (non-UPX), with standard section names and no debugger checks beyond IsDebuggerPresent in the IAT. Evasion comes entirely from script-level logic inside the encrypted bytecode.^[pefile.txt:556]

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 or later on Windows 7+.

1. Install AutoIt from https://www.autoitscript.com/site/autoit/downloads/.
2. Write a simple script (test.au3) that calls InetRead(), RegWrite(), and PixelChecksum().
3. Compile with Aut2Exe.exe (right-click → Compile Script, or CLI: Aut2Exe.exe /in test.au3 /out test.exe).
4. The output will be a PE32 with 5 sections, a SCRIPT resource in .rsrc, and AU3!EA06 header bytes.

Verification:

• Run capa test.exe — it should emit the same AutoIt limitation warning.
• Run pefile.py or rabin2 -I — confirm RT_RCDATA resource named SCRIPT and AU3!EA06 strings.
• Compare import table to this sample: you should see WININET, WSOCK32, GDI32, USER32, ADVAPI32, SHELL32.

What you'll learn: How a BASIC-like scripting language can produce a statically opaque PE that defeats capa, confuses triage pipelines, and requires decompiler tooling (MyAut2Exe) to recover the actual payload.

Deployable Signatures

YARA rule

rule AutoItSC_SingleFile_PE32_DHL_Lure
{
    meta:
        description = "AutoIt v3 single-file compiled PE32 with encrypted SCRIPT resource"
        author = "PacketPursuit SOC"
        date = "2026-06-20"
        sha256 = "f618a8619ab45629df06d80a6d5fec78962a679dbaaca29cf51cf9261973486f"
        family = "unclassified-autoit-compiled"
    strings:
        $au3_hdr = "AU3!EA06"
        $autoit_err1 = "This is a third-party compiled AutoIt script."
        $autoit_err2 = "AutoIt has detected the stack has become corrupt."
        $autoit_err3 = "AutoIt Error"
        $pcre_err1 = "numbers out of order in {} quantifier"
        $pcre_err2 = "unrecognized character follows \\"
        $wininet = "WININET.dll" ascii wide
        $wsock32 = "WSOCK32.dll" ascii wide
        $gdi32 = "GDI32.dll" ascii wide
        $advapi32 = "ADVAPI32.dll" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        $au3_hdr and
        2 of ($autoit_err*) and
        1 of ($pcre_err*) and
        3 of ($wininet, $wsock32, $gdi32, $advapi32)
}

Behavioral hunt query (KQL / Microsoft Defender for Endpoint)

DeviceProcessEvents
| where FileName endswith ".exe"
| where ProcessCommandLine contains "DHL" or ProcessCommandLine contains "AWB" or ProcessCommandLine contains "TRACKING"
| join kind=inner (
    DeviceNetworkEvents
    | where InitiatingProcessFileName endswith ".exe"
    | where RemoteUrl !contains "microsoft.com" and RemoteUrl !contains "windowsupdate.com"
) on DeviceId, InitiatingProcessCreationTime
| where TimestampDiff <= 5m
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, InitiatingProcessFileName

IOC list

Detection Signatures

• capa limitation: compiled with AutoIt — capa aborts because the threat logic is in the encrypted script. No ATT&CK mapping is generated by capa for this sample.^[capa.txt]
• Inferred ATT&CK mapping (from runtime import surface and cluster behavior):
  • T1059.005 — Command and Scripting Interpreter: Visual Basic / AutoIt (script execution)
  • T1071.001 — Application Layer Protocol: Web Protocols (WinInet HTTP/FTP)
  • T1095 — Non-Application Layer Protocol (WinSock raw sockets)
  • T1547.001 — Registry Run Keys / Startup Folder (ADVAPI32 RegSetValueExW)
  • T1053.005 — Scheduled Task/Job: Scheduled Task (script-side Run or COM)
  • T1083 — File and Directory Discovery
  • T1057 — Process Discovery (CreateToolhelp32Snapshot)
  • T1012 — Query Registry (RegQueryValueExW)
  • T1113 — Screen Capture (GDI32)
  • T1115 — Clipboard Data (USER32 GetClipboardData)
  • T1056.001 — Input Capture: Keylogging (GetAsyncKeyState)

References

• OpenCTI artifact: 4e624ae1-f2bf-42c0-b2a6-8d7aeaa81de9^[metadata.json]
• MalwareBazaar source: abuse.ch payload feed
• Cluster entity page: unclassified-autoit-compiled
• Related concept: autoit-compiled-script-dropper
• Related entity: asgardprotector (IExpress SFX + AutoIt3 variant)

Provenance

Analysis derived from file.txt, exiftool.json, pefile.txt, strings.txt, capa.txt, binwalk.txt, rabin2-info.txt, metadata.json, and triage.json gathered by the triage pipeline on 2026-05-26. capa v8.x (rule set 2024-xx). pefile.py. radare2 rabin2 -I. No CAPE detonation available (no Windows guest). Static-only inference.