unclassified-autoit-compiled: fb495efe — UPX-packed Invoice.exe (variant of 2c6133ca)

Executive Summary

UPX-packed variant of the previously documented 2c6133ca (Invoice.exe) sibling. Unpacking with upx -d produces SHA-256 2c6133ca... — an exact byte-for-byte match. The packed form (685 KB) is roughly 59%% the size of the unpacked form (1.14 MB). All threat logic remains inside the 311 KB encrypted AutoIt SCRIPT resource; UPX only compresses the interpreter runtime stub.^[file.txt]^[terminal:upx-decompress]^[terminal:sha256-verify]

What It Is

Relationship to cluster: Packed variant of 2nd confirmed sibling (2c6133ca). Same Invoice.exe filename, same 311 KB SCRIPT resource, same Jul 2024 build timestamp, same import table. Only delta is UPX compression applied to the PE stub. MalwareBazaar label upx-dec refers to this packed form.^[terminal:sha256-verify]^[terminal:resource-extract]

How It Works

1. UPX decompression at launch: The packed PE has three sections — UPX0 (VirtualSize=860160, RawSize=0), UPX1 (RawSize=353280), and .rsrc (RawSize=330752). The UPX stub decompresses the interpreter into UPX0 at runtime.^[pefile.txt]^[terminal:upx-decompress]
2. AutoItSC bootstrap: After decompression, the standard AutoIt v3 single-file runtime initializes. The marker This is a third-party compiled AutoIt script. is present in the unpacked image.^[strings.txt:3768]
3. SCRIPT resource: A single RT_RCDATA resource named SCRIPT of 311,356 bytes sits in .rsrc. The header AU3!EA06 is present. Identical 311,356-byte resource exists in both packed and unpacked forms — UPX does not touch the resource section.^[terminal:resource-extract]
4. Runtime surface: Same import table as 2c6133ca — WinInet/WinSock for network, ADVAPI32 for token manipulation and registry, GDI32 for screenshots, KERNEL32 for process/memory operations. No new imports surface due to packing.^[pefile.txt]

Build / RE

Packing

• Packer: UPX 3.x (NRV or UCL compression). Signatures visible in packed strings: $Id: UPX... references and the standard UPX section names.^[strings.txt]
• Compression ratio: Packed 685 KB → unpacked 1.14 MB (~59.3%% of original). Typical for UPX on PE32.
• Packed section layout:
  • UPX0 — uninitialized decompression buffer (RawSize=0, VirtualSize=860160)
  • UPX1 — packed code + decompressor stub (RawSize=353280)
  • .rsrc — resources including SCRIPT (RawSize=330752)
• Unpacking: Standard upx -d succeeds cleanly; no anti-UPX tricks observed.^[terminal:upx-decompress]

Unpacked Binary Structure

• 5 sections: .text (entropy 6.68), .rdata (5.68), .data (1.20), .rsrc (7.89), .reloc (6.78)
• High .rsrc entropy (7.89): Driven by the encrypted SCRIPT blob, not additional packing.
• No exports: Standard AutoItSC — all behavior via imports.^[rabin2-info.txt]
• Import table: 12 DLLs, 150+ imports. Same profile as all siblings in this cluster.^[pefile.txt]

Anti-Analysis

• Static: UPX provides a thin layer of obfuscation. Easily removed.
• Runtime: IsDebuggerPresent imported in the unpacked binary. No VM-detection strings found in packed or unpacked forms.^[pefile.txt]
• Script layer: The compiled AutoIt bytecode is natively opaque — no anti-analysis in the outer binary beyond UPX.^[strings.txt]

Decompiled Behavior

No meaningful new decompilation over 2c6133ca. The packed binary adds only the UPX decompressor stub (~2 KB of assembly). After unpacking, Ghidra/radare2 see the same AutoIt interpreter runtime already analyzed in the sibling report. All behavioral decisions remain inside the 311 KB encrypted SCRIPT resource.^[ghidra:FUN_140003a20]^[r2:sym.__acrt_iob_func]

C2 Infrastructure

None recovered statically — identical to 2c6133ca. The outer binary contains no hardcoded network indicators. C2 endpoints, ports, and protocols are runtime-resolved from within the compiled AutoIt script. The import table confirms capability for both WinInet (HTTP/HTTPS/FTP) and WinSock (raw sockets).

Interesting Tidbits

• Packing explains the MalwareBazaar upx-dec label: The prior analysis of 2c6133ca reported "No UPX" because the sample received was already unpacked. fb495efe is the packed form that carries that label.^[metadata.json]
• Resource integrity: The SCRIPT resource is byte-identical pre- and post-UPX decompression. This confirms UPX is a pure transport-layer optimization, not a content transformation.^[terminal:resource-extract]
• Same filename, same lure: Both packed and unpacked forms carry Invoice.exe — a business-document social-engineering lure consistent with the cluster's targeted-phishing pattern.^[metadata.json]
• String delta: Packed strings include 5,249 unique artifacts (UPX signatures, decompressor strings); unpacked strings include 3,840 unique artifacts (interpreter error messages, PCRE tables). 4,012 strings are common to both forms.^[terminal:string-diff]

Deployable Signatures

YARA — UPX-packed AutoItSC variant

rule UPX_Packed_AutoItSC_Invoice {
    meta:
        description = "UPX-packed AutoItSC with Invoice.exe filename"
        family = "unclassified-autoit-compiled"
        confidence = "medium"
    strings:
        $upx1 = { UPX! }
        $upx2 = "UPX0" ascii wide
        $upx3 = "UPX1" ascii wide
        $au3 = "AU3!EA06" ascii
        $invoice = "Invoice.exe" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and
        any of ($upx*) and
        $au3 and
        $invoice
}

Detection Notes

• UPX unpacking recommended: The upx-dec MalwareBazaar tag is accurate — unpack before static string/hunt analysis. The SCRIPT resource is accessible without unpacking (it's in .rsrc), but the interpreter code and strings are compressed.
• FLOSS/capa on packed: Will return limited results; run on unpacked binary for full coverage.^[capa.txt]^[floss.txt]

How To Mess With It (Homelab Replication)

1. Take any existing unclassified-autoit-compiled sibling (e.g., 2c6133ca unpacked).
2. Pack with upx --best -o output.exe input.exe.
3. Verify: packed SHA should differ; unpacked SHA should match original.
4. Run capa on both — packed will show reduced rule hits.
5. Confirm .rsrc SCRIPT resource is byte-identical via pefile or Resource Hacker.

Analysis: static-only. No CAPE detonation (no Windows guest). Packed sample preserved as sample.bin in this directory.