DllCallAddress Shellcode Execution

Overview

An AutoIt-specific technique for executing shellcode reflectively. The AutoIt script decodes a payload (typically hex-encoded or XOR-encrypted shellcode), allocates executable memory via VirtualAlloc with PAGE_EXECUTE_READWRITE (0x40), and calls the shellcode entry point using DllCallAddress at a fixed hardcoded offset — most commonly 0x23b0.

Mechanism

1. Payload staging: Shellcode is delivered as a string (hex-encoded or obfuscated) inside the AutoIt script, or as a companion file dropped to %TEMP%.
2. Memory allocation: VirtualAlloc(0, size, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE) — 0x3000 and 0x40 flags. ^[script.au3]
3. Decoding: The script copies decoded bytes into the RWX buffer.
4. Execution: DllCallAddress("int", $buffer + 0x23b0) transfers control to the shellcode.

Cluster Context

The fixed offset 0x23b0 is a cluster hallmark across the unclassified-autoit-compiled family. Siblings using this exact offset include:

• 127c404a — reaffection shellcode executed at 0x23b0.
• 6718622d — Lityerses shellcode executed at 0x23b0.
• 498f7bf3 — shellcode executed at 0x23b0.
• 54ad2eac — sulfhydric shellcode executed at 0x23b0 (some variants use 9136 for alternate entry).

Detection

• AutoIt processes calling DllCallAddress with a pointer derived from VirtualAlloc.
• RWX memory regions in AutoIt3.exe or the compiled AutoItSC process.
• Suspicious VirtualAlloc calls from AutoIt processes with PAGE_EXECUTE_READWRITE.

Related

• autoit-shellcode-xor-decryptor — payload decryption technique
• process-hollowing-svchost-regsvcs — post-shellcode process injection
• unclassified-autoit-compiled — parent cluster