unclassified-autoit-compiled: ff84806a — Jan 2012 AutoItSC v3.3.8.1, script-in-overlay variant

Executive Summary

AutoIt v3.3.8.1 single-file compiled PE32 (AutoItSC) with a 694 KB encrypted compiled script stored in the file overlay rather than the .rsrc section — a deployment-variant delta from the two confirmed siblings (ac2ca060, 2c6133ca). Dated Jan 2012, this is the oldest observed build in the cluster. Social-engineering filename masquerades as a bureaucratic facility-inspection document. No hardcoded C2 strings recovered; threat logic is opaque without AutoIt decompilation. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

• SHA-256: ff84806a2a126d998d52b895d71e137acd313ca92dc0c1445bd0ba6509df7a4f
• File: past_years_visit_09972_facility_inspection_487607_purpose_2023__possible_questions_and_answers__from_the_Bureau_also_purpose_of_visit_appendix_Drafted_and_scanned.exe (1,344,071 bytes) ^[file.txt]
• Format: PE32 executable (GUI) Intel 80386, 4 sections ^[file.txt]
• Compiler: MSVC 14.x (AutoItSC runtime), LinkerVersion 10.0, timestamp Sun Jan 29 21:32:28 2012 UTC ^[exiftool.json] ^[pefile.txt]
• Version info: AutoIt v3 Script: 3, 3, 8, 1 ^[exiftool.json] ^[pefile.txt]
• Signing: Unsigned (no Authenticode) ^[rabin2-info.txt]
• Overlay: 694,855 bytes at file offset 0x9e800, header AU3!EA06 — AutoIt compiled encrypted bytecode, not embedded as an .rsrc resource. ^[strings.txt:1109]
• Family ascription: Third confirmed sibling in the unclassified-autoit-compiled cluster.

How It Works

The binary is the standard AutoIt single-file compiler (AutoItSC) output: a statically-linked C++ runtime PE that decrypts and interprets an appended compiled AutoIt script. Unlike siblings ac2ca060 (802 KB .rsrc SCRIPT resource) and 2c6133ca (311 KB .rsrc SCRIPT resource), this sample stores its payload in the PE overlay after the last section. ^[pefile.txt] This is a valid AutoItSC deployment option and does not affect runtime behaviour, but it changes static extraction offsets.

The overlay begins with 16 bytes of padding followed by the AU3!EA06 magic and encrypted script body. ^[strings.txt:1109] Without decompilation (e.g. MyAut2Exe / Exe2Aut), the script logic — C2 URLs, persistence commands, payload downloaders — is opaque.

The import table is the full AutoIt v3.3.8.1 runtime surface: ^[pefile.txt]

• Network: WSOCK32 (socket/connect/send/recv/WSAStartup), WININET (HttpOpenRequestW/HttpSendRequestW/InternetOpenUrlW/FtpOpenFileW), ICMP.DLL (IcmpCreateFile, IcmpSendEcho) — the ICMP suite is notable for host-reconnaissance.
• Process / Injection: VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, OpenProcess, CreateProcessW, CreateThread, ResumeThread.
• Privilege / Token: OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, LogonUserW.
• Persistence / Registry: RegSetValueExW, RegCreateKeyExW, RegOpenKeyExW, RegEnumKeyExW, RegDeleteValueW.
• Discovery / Collection: PSAPI (EnumProcesses, GetModuleBaseNameW), CreateToolhelp32Snapshot, Process32FirstW/NextW, GDI32 screenshot suite (GetDIBits, StretchBlt, CreateCompatibleDC), USER32 clipboard suite (GetClipboardData, SetClipboardData, OpenClipboard), GetAsyncKeyState.
• File system: Full KERNEL32 file/directory/registry/profile APIs plus SHELL32 (SHGetFolderPathW, ShellExecuteExW).

The .text section entropy is 6.68 — normal for a statically-linked C++ runtime. ^[pefile.txt] No packing, no anti-debug stubs in the outer binary. The natural obfuscation is the compiled AutoIt bytecode itself.

Decompiled Behavior

Ghidra / radare2 analysis of the outer C++ runtime was not pursued because the AutoIt interpreter stub is well-documented and the threat logic lives entirely in the encrypted overlay. Decompilation of the overlay requires AutoIt-specific tools (MyAut2Exe, Exe2Aut) which are not available in this environment. The static import table and known AutoIt malware patterns support the TTP inferences below.

C2 Infrastructure

No hardcoded domains, IPs, URLs, mutexes, or named pipes recovered from static artifacts. C2 is presumed to be runtime-resolved by the compiled AutoIt script. ^[strings.txt] ^[floss.txt]

Interesting Tidbits

• Script-in-overlay vs resource-in-.rsrc: The two prior siblings store SCRIPT as an RT_RCDATA resource (type 0xA). This sample places the AU3!EA06 block in the file overlay. Extraction tooling must check both locations. ^[pefile.txt] ^[strings.txt:1109]
• ICMP reconnaissance: Import of IcmpCreateFile / IcmpSendEcho from ICMP.DLL is present in this build but not highlighted for prior siblings. AutoIt malware rarely uses ICMP directly; this may indicate a network-reconnaissance or C2-availability check function in the script. ^[strings.txt:517-520]
• Bureaucratic lure: Filename length (~120 chars) mimics government document naming conventions (facility_inspection_487607_purpose_2023__possible_questions_and_answers__from_the_Bureau). Social-engineering target is likely public-sector or compliance-oriented recipients.
• Oldest build in cluster: Jan 2012 timestamp predates the next sibling by >11 years. Either this is a genuinely old sample resurfacing in 2026, or the timestamp is fabricated. The AU3!EA06 header format is consistent with AutoIt v3.3.x-era compiles.
• No CAPE detonation: No Windows guest available at time of triage. All TTPs are inferred from static import profiling and cluster behaviour. ^[dynamic-analysis.md]

How To Mess With It (Homelab Replication)

Goal: Produce a comparable AutoItSC binary for detection-tuning and signature validation.

1. Toolchain: Install AutoIt v3.3.8.1 (or latest SciTE4AutoIt3 bundle) on a Windows 10/11 research VM.
2. Script: Write a minimal AutoIt script that:
   • Calls InetRead() or HttpSetRequestProxy() to fetch a remote payload
   • Writes to %TEMP%\stage.exe via FileWrite()
   • Calls RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Update", "C:\\Users\\...") for persistence
   • Uses DllCall("kernel32.dll", "VirtualAllocEx", ...) to demonstrate the import surface
3. Compile: Right-click → Compile Script (x86). This produces a single PE32 with the AutoItSC runtime + encrypted script overlay.
4. Verify:
   • Run strings -n 8 reproducer.exe | grep AU3 → should show AU3!EA06
   • Run capa reproducer.exe → should flag the AutoIt limitation warning identical to ^[capa.txt]
   • Check imports with python3 -m pefile reproducer.exe → should mirror the WSOCK32/WININET/KERNEL32/ADVAPI32 surface observed here.
5. What you'll learn: How AutoItSC binaries appear in PE analysis tools and why standard static analysis fails to reveal script-level C2 logic.

Deployable Signatures

YARA Rule

rule AutoItSC_SingleFile_Compiled_PE32
{
    meta:
        description = "AutoIt v3 single-file compiled PE32 (AutoItSC) with encrypted script overlay or resource"
        author = "PacketPursuit"
        date = "2026-06-17"
        sha256 = "ff84806a2a126d998d52b895d71e137acd313ca92dc0c1445bd0ba6509df7a4f"
        family = "unclassified-autoit-compiled"
    strings:
        $au3_magic = "AU3!EA06"
        $au3_text = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support."
        $autoit_err1 = "AutoIt Error"
        $autoit_err2 = "AutoIt has detected the stack has become corrupt"
        $autoit_err3 = "Badly formatted \"Func\" statement."
        $s_wsock = "WSOCK32.dll" ascii wide
        $s_wininet = "WININET.dll" ascii wide
        $s_userenv = "USERENV.dll" ascii wide
        $s_icmp1 = "IcmpCreateFile" ascii wide
        $s_icmp2 = "IcmpSendEcho" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        (
            ($au3_magic in (0..filesize)) or
            ($au3_text in (0..filesize))
        ) and
        3 of ($s_*) and
        filesize > 200KB
}

Sigma Rule

title: AutoIt Compiled Script Execution - Suspicious Network Activity
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'AutoIt'
      - '.a3x'
    Image|endswith:
      - '\\AutoIt3.exe'
  network:
    Initiated: 'true'
  suspicious_parent:
    ParentImage|endswith:
      - '\\explorer.exe'
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\mshta.exe'
  condition: selection and network and suspicious_parent
falsepositives:
  - Legitimate AutoIt automation scripts in enterprise environments
level: medium

IOC List

Behavioral Fingerprint

This binary is a single-file AutoIt compiled PE32 (AutoItSC v3.3.8.1) containing an encrypted script overlay starting with the AU3!EA06 magic. On execution, the C++ runtime bootstrap decrypts the overlay into memory and hands control to the AutoIt interpreter. The import table includes the full Win32 surface: WSOCK32 and WININET for HTTP/FTP/socket C2; KERNEL32 for file/process/registry manipulation; ADVAPI32 for token privilege escalation and registry persistence; USER32/GDI32 for screenshot and clipboard harvesting; and ICMP.DLL for host-reconnaissance pings. No anti-analysis code is present in the outer binary; all evasion and C2 logic is opaque inside the compiled AutoIt bytecode.

Detection Signatures

References

• unclassified-autoit-compiled — entity page for the cluster
• autoit-compiled-script-dropper — concept page covering AutoIt deployment patterns
• Analysis siblings: ac2ca060 (802 KB .rsrc SCRIPT, May 2023), 2c6133ca (311 KB .rsrc SCRIPT, Jul 2024)
• AutoIt decompiler references: MyAut2Exe, Exe2Aut (not available in this environment)
• MalwareBazaar artifact: 5a74c1bd-0807-419f-89f6-22e44ddabd48

Provenance

Analysis based on static artifacts generated 2026-05-26. Tools: file, exiftool, python3 -m pefile, strings, xxd, rabin2 -I (radare2), capa. No dynamic execution performed (CAPE skipped — no Windows guest). All claims cite source file and line number where applicable.