IExpress SFX Dropper

The Microsoft IExpress/Wextract self-extractor (wextract.exe) repurposed as a malware dropper. The outer PE is a legitimate Windows system binary that extracts an embedded Cabinet archive to a temp directory and executes a post-extraction command defined in a Self-Extraction Directive (SED).

Pattern Definition

1. Outer PE: wextract.exe or a binary with wextract.pdb.
2. Embedded CAB: Stored in .rsrc, extracted to %TEMP%\msdownld.tmp or similar.
3. SED directives: RUNPROGRAM, POSTRUNPROGRAM, REBOOT, SHOWWINDOW stored as string resources.
4. Execution: The RUNPROGRAM command is launched via CreateProcess after extraction.

Variants

• Signed variant: Original IExpress output retains Microsoft Authenticode. Rarely seen in malware because the CAB and SED must be embedded at build time.
• Unsigned/repacked variant: More common. The SFX is rebuilt or resource-edited to strip the signature, modify the CAB, and change the timestamp. Seen in asgardprotector.
• Signed resource-replacement variant: The attacker replaces only the .rsrc/CABINET resource inside a signed wextract.exe, leaving the Authenticode signature intact because the signature hash does not cover the resource directory. Observed in 54e64e (7aed04ab).^[/intel/analyses/7aed04abf7cc42695481b89e4db2e8760eb56dd0fafc7da9f13a43c1158efc5e.html]

Defensive Detection

• PE with wextract.pdb but no valid Microsoft signature.
• .rsrc entropy >7.0 and size >1 MB (CAB payload).
• Parent process wextract.exe spawning unexpected child processes (e.g., AutoIt3.exe, .vbs, .bat).
• wextract.exe spawning cmd.exe with command lines containing >20 %VAR% tokens (batch reconstruction stage).

Cross-References

• asgardprotector — family using this pattern
• autoit-compiled-script-dropper — payload type commonly paired with this concept