> Technique · autoit-overlay-script-placement_

~/packetpursuit $ cat /intel/techniques/autoit-overlay-script-placement.md

typetechniqueconfidencehighcreated2026-07-20updated2026-07-20autoitevasionpeoverlayextraction

autoit-overlay-script-placement

Placement of a compiled AutoIt v3 script in the file overlay (after the last PE section) rather than inside a .rsrc RT_RCDATA resource. This evades automated extraction tools such as autoit-ripper, which search exclusively for PE resource directories.

Detection / Fingerprint

  • Overlay starts immediately after .rsrc VirtualSize / SizeOfRawData boundary — no padding gap ^[/intel/analyses/e08d5bcefbe1a2672589b457ddf11c7f2bfcb9d2151b75cea5213b820e56dc95.html:31]
  • Script header AU3!EA06 appears at overlay offset 0x00 or 0x10–0x20 (some samples prepend a 16-byte encryption prefix) ^[/intel/analyses/e08d5bcefbe1a2672589b457ddf11c7f2bfcb9d2151b75cea5213b820e56dc95.html:35]
  • No RT_RCDATA resource with ID SCRIPT present in .rsrc directory tree ^[/intel/analyses/e08d5bcefbe1a2672589b457ddf11c7f2bfcb9d2151b75cea5213b820e56dc95.html:59]
  • Entropy ~7.9–8.0 across the overlay — strong encryption or compressed bytecode ^[/intel/analyses/e08d5bcefbe1a2672589b457ddf11c7f2bfcb9d2151b75cea5213b820e56dc95.html:32]
  • autoit-ripper fails with Couldn't find any appropiate PE resource directory / Couldn't find the script resource ^[/intel/analyses/e08d5bcefbe1a2672589b457ddf11c7f2bfcb9d2151b75cea5213b820e56dc95.html:35]

Implementation Patterns

  1. Build a standard AutoIt v3 script and compile with Aut2Exe.exe.
  2. Some AutoItSC versions or post-build modification place the compiled script after the last section rather than embedding it as a PE resource.
  3. The AutoItSC runtime locates the script by reading the PE file from disk (GetModuleFileNameW) and seeking to the end-of-file minus script size, or by scanning for the AU3!EA06 magic.
  4. The script is decrypted at runtime by the AutoIt interpreter (standard AutoItSC behavior).

Reproduce on your own VMs

  1. Install AutoIt v3.3.8.1 on Windows.
  2. Write payload.au3 and compile with Aut2Exe.exe /in payload.au3 /out dropper.exe.
  3. Check PE structure with rabin2 -S dropper.exe or a Python pefile script. If the compiled script is larger than the .rsrc section, it may overflow into the overlay.
  4. Attempt extraction with autoit-ripper dropper.exe out/ — failure confirms overlay placement.
  5. Manual extraction: parse the PE header, compute last-section end offset, read from that offset to EOF, and verify AU3!EA06 at offset 0x00 or 0x10.

Verification: strings -n 6 dropper.exe | grep AU3 should show AU3!EA06 near the end of output, not inside a .rsrc hex dump.

Defensive Countermeasures

  • Do not rely solely on autoit-ripper or resource-only extraction pipelines for AutoItSC samples.
  • Parse the PE overlay in triage: compare file_size vs last_section.PointerToRawData + last_section.SizeOfRawData. A non-zero delta indicates overlay data.
  • Hunt for AU3!EA06 anywhere in the file, not just inside .rsrc.
  • Monitor AutoItSC runtime execution for GetModuleFileNameW followed by large file-read operations near EOF.

Pages where observed

  • unclassified-autoit-compiled — entity page (eleven confirmed overlay-placed siblings)
  • /intel/analyses/e08d5bcefbe1a2672589b457ddf11c7f2bfcb9d2151b75cea5213b820e56dc95.html