unclassified-autoit-compiled: fb5bc543 — 690 KB DHL-lure script in overlay, AutoItSC v3.3.8.1

Executive Summary

AutoIt v3 single-file compiler (AutoItSC) PE32 with a 690 KB encrypted compiled script stored in the file overlay (AU3!EA06 magic). Delivered as a DHL logistics lure (Custom_brief_declaration_notification_for_DHL_2024sept.exe). Jan 2012 PE timestamp and AutoItSC v3.3.8.1 runtime. No CAPE detonation available. Static-only inference. Fifteenth confirmed sibling of the unclassified-autoit-compiled cluster.

What It Is

How It Works

AutoItSC runtime loads the encrypted compiled script from the file overlay and decrypts/executes it in-memory. The overlay begins at raw offset 0x9E800 immediately after the .rsrc section, is 706,971 bytes (690.4 KB), and carries the AU3!EA06 magic confirming AutoIt compiled script placement.^[terminal: python pefile overlay extraction] This is the third cluster sibling with script-in-overlay placement (after ff84806a and e5647a2d), and the second-largest overlay script observed.

Lure theme: DHL brief declaration notification (Custom_brief_declaration_notification_for_DHL_2024sept.exe). Falls under the social-engineering-filename-lure pattern targeting logistics/shipping urgency.

Script size: 690 KB is in the upper third of the cluster (range 186 KB–932 KB), suggesting a feature-rich payload. The actual behavior is opaque statically because AutoIt compiled bytecode is encrypted and capa cannot analyze it.^[capa.txt]

Import surface: Standard AutoItSC v3.3.8.1 runtime DLL set — KERNEL32, USER32, GDI32, ADVAPI32, SHELL32, ole32, OLEAUT32, WSOCK32, WININET, COMCTL32, MPR, PSAPI, USERENV, VERSION, WINMM, COMDLG32.^[pefile.txt] Full WinInet client surface (HTTP/HTTPS/FTP) and raw WinSock surface are present, enabling C2 over both application-layer and non-application-layer protocols. The PSAPI and USERENV imports suggest process enumeration and user-profile manipulation. ADVAPI32 includes token privilege adjustment (AdjustTokenPrivileges), service manager (OpenSCManagerW), and registry write APIs (RegSetValueExW, RegCreateKeyExW), enabling persistence and privilege escalation.

PCRE regex library: The binary contains the full PCRE error-message table and Unicode property-name strings (Arabic, Armenian, Bengali, … Ugaritic), indicating the AutoIt runtime includes PCRE regex support.^[strings.txt:369-444] Script-level regex usage (e.g., data harvesting, pattern matching) is probable but unverifiable statically.

Icons: 12 individual icon resources (IDs 0x1–0xC) in RT_ICON, grouped under RT_GROUP_ICON.^[pefile.txt] The icon suite is richer than the typical 1–4 icon sets seen in many cluster siblings, potentially improving social-engineering credibility.

Decompiled Behavior

Ghidra analysis of the AutoIt interpreter runtime yields standard AutoItSC v3.3.8.1 C code (event loop, script loader, DllCall dispatcher, COM wrapper). The malicious logic lives in the encrypted AU3!EA06 bytecode in the overlay, which Ghidra does not decode. Without MyAut2Exe or dynamic execution, script-level control flow and API call sequences are opaque.^[capa.txt]

C2 Infrastructure

No hardcoded domains, IPs, or URLs recoverable from static analysis. The script's network configuration is encrypted inside the overlay bytecode. C2 protocol inference is limited to the WinInet/WinSock import surface:

• HTTP/HTTPS via HttpOpenRequestW, HttpSendRequestW, InternetReadFile ^[pefile.txt]
• FTP via FtpOpenFileW, FtpGetFileSize ^[pefile.txt]
• Raw TCP/UDP via socket, connect, send, recv ^[pefile.txt]

Interesting Tidbits

• Overlay script placement: Third sibling in the cluster with script stored in file overlay rather than .rsrc RT_RCDATA. The other two are ff84806a (694 KB) and e5647a2d (710 KB). This placement may be an operator preference or a build-flag variant in the AutoIt compiler.^[terminal: python pefile overlay extraction]
• Large script: 690 KB places this in the top 20% of observed script sizes in the cluster, suggesting extensive functionality (possibly multiple modules, extensive C2 logic, or bundled payloads).
• 12 icon resources: Unusually rich icon suite compared to the 1–4 icons typical in this cluster. May reflect a more polished social-engineering package.
• PCRE presence: Full PCRE regex library is present in the runtime, but not all cluster siblings include it. This may indicate script-side regex usage for data parsing or credential harvesting.
• Empty VS_VERSIONINFO: FileDescription is blank, leaving only CompiledScript and FileVersion as version indicators.^[pefile.txt]
• FLOSS failure: flare-floss failed with argument parsing error (--no flag collision), yielding no decoded strings.^[floss.txt]

How To Mess With It (Homelab Replication)

Toolchain: AutoIt v3.3.8.1 (or later) on Windows, AutoItSC compiler.

Steps:

1. Install AutoIt v3.3.8.1 from the AutoIt website.
2. Write a benign AutoIt script that exercises WinInet, WinSock, and registry APIs.
3. Compile with AutoItSC.exe (right-click → Compile Script) to produce a single-file PE32.
4. Verify the output has AU3!EA06 in the overlay or .rsrc (depending on compiler settings).
5. Run capa on the output; it should flag the autoit file limitation warning.

Verification: Compare capa output to the cluster's capa.txt — should show the same AutoIt limitation warning with no actionable capabilities.

Deployable Signatures

YARA rule:

rule AutoItSC_DHL_Overlay_Script {
    meta:
        description = "AutoItSC v3.3.8.1 PE with large overlay script and DHL logistics lure"
        author = "PacketPursuit"
        sha256 = "fb5bc5438cc0be0978fc6723d1f063e32b1fd5df4d3c45599e474796d5d9ab6a"
    strings:
        $au3_magic = "AU3!EA06" ascii
        $autoit_str = "This is a compiled AutoIt script." ascii
        $dhl_lure1 = "DHL" ascii wide nocase
        $dhl_lure2 = "declaration" ascii wide nocase
        $dhl_lure3 = "notification" ascii wide nocase
        $compiled = "CompiledScript: AutoIt v3 Script: 3, 3, 8, 1" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 4 and
        pe.subsystem == pe.SUBSYSTEM_WINDOWS_GUI and
        $au3_magic and
        $autoit_str and
        ($dhl_lure1 or $dhl_lure2 or $dhl_lure3) and
        filesize > 1MB and filesize < 2MB
}

Behavioral hunt query (KQL / Microsoft Defender):

DeviceFileEvents
| where FileName contains "DHL" and (FileName contains "declaration" or FileName contains "notification")
| where FileName endswith ".exe"
| join kind=inner (
    DeviceProcessEvents
    | where InitiatingProcessFileName =~ "explorer.exe"
) on DeviceId, $left.FileName == $right.FileName
| where FileSize > 1350000 and FileSize < 1400000

IOC list:

• SHA-256: fb5bc5438cc0be0978fc6723d1f063e32b1fd5df4d3c45599e474796d5d9ab6a
• File size: 1,356,187 bytes
• File name observed: Custom_brief_declaration_notification_for_DHL_2024sept.exe
• Overlay script size: 706,971 bytes
• AutoIt version: 3.3.8.1
• PE timestamp: 2012-01-29 21:32:28 UTC
• Icon count: 12 (RT_ICON IDs 0x1–0xC)

Behavioral fingerprint: AutoItSC v3.3.8.1 PE32 GUI executable with empty FileDescription, 12 icon resources, and a 690 KB encrypted compiled script in the file overlay. Launches as a single process with no child processes (script runs inside the interpreter). Contacts remote hosts via WinInet HTTP/HTTPS or raw WinSock within minutes of execution. May write to registry Run keys or create scheduled tasks for persistence.

Detection Signatures

References

• unclassified-autoit-compiled — cluster entity page with shared TTPs and build fingerprint
• social-engineering-filename-lure — concept page for professional-context filename lures
• autoit-compiled-script-dropper — concept page for AutoIt deployment patterns
• MalwareBazaar artifact: fbbed006-bc39-431f-8f6b-6caab0f2aa60

Provenance

• file.txt — PE type identification
• pefile.txt — PE structure, imports, resources, version info
• exiftool.json — metadata extraction
• strings.txt — ASCII/Unicode strings
• capa.txt — capability detection (AutoIt limitation warning)
• rabin2-info.txt — radare2 binary header summary
• yara.txt — PE_File_Generic, Suspicious_Wininet_Imports
• binwalk.txt — binwalk surface scan (no meaningful embedded artefacts)
• triage.json — triage classification
• floss.txt — flare-floss failed with argument error
• dynamic-analysis.md — CAPE skipped (no Windows guest)
• Terminal: Python overlay offset/size calculation via pefile module