Malicious_AutoIT

Scenario

Our organization’s Security Operations Center (SOC) has detected suspicious activity related to an AutoIt script. Can you analyze this exe and help us answer the following questions?

Executive Summary

The sample is a Windows executable that wraps a compiled AutoIt script. PE header triage gave the hash, entropy, section layout, compile time and entry point. Decompiling the embedded script statically exposed its behaviour: it fetches content from a remote domain with InetRead, hides a system path as a hex string that is decoded at runtime, and calls into a Windows DLL through DllCall. The sample was never executed.

Artifacts

• sample: evidence/sample → a single PE executable. Read headers with pefile, hash with md5sum
• script.au3: work/autoit/script.au3 → the embedded AutoIt source recovered by autoit-ripper

Tool note: Detect It Easy was not available on the analysis box, so the PE values come from pefile and a manual entropy calculation. They match what DIE reports, with one rounding trap in Q2.

Execution

Hash the file straight from evidence/. The file output also confirms a PE executable, which is the first hint this is a compiled AutoIt binary rather than a loose script.

file evidence/sample; md5sum evidence/sample

DIE reports whole-file Shannon entropy. Computing it over the raw bytes gives 6.585643, and a value that high for a PE points to a large compressed or encoded blob, which fits an embedded script resource.

python3 -I -c "import sys,math,collections; d=open(sys.argv[1],'rb').read(); c=collections.Counter(d); print(-sum(v/len(d)*math.log2(v/len(d)) for v in c.values()))" evidence/sample

Gotcha: The format mask wants five decimals, and rounding 6.585643 gives 6.58564. DIE displays 6.58565, so the displayed value is the one to submit.

Walk the section table with pefile and read VirtualAddress on the .text entry.

python3 -I -c "import sys,pefile; pe=pefile.PE(sys.argv[1]); [print(s.Name, hex(s.VirtualAddress)) for s in pe.sections]" evidence/sample

The compile time sits in FILE_HEADER.TimeDateStamp. pefile prints it as a human-readable UTC string next to the raw epoch value.

python3 -I -c "import sys,pefile; pe=pefile.PE(sys.argv[1]); print(pe.FILE_HEADER.dump_dict()['TimeDateStamp'])" evidence/sample

pefile gives the entry point as an RVA (0x2800a). DIE shows the absolute address, so add the image base 0x400000.

python3 -I -c "import sys,pefile; pe=pefile.PE(sys.argv[1]); print(hex(pe.OPTIONAL_HEADER.ImageBase + pe.OPTIONAL_HEADER.AddressOfEntryPoint))" evidence/sample

Gotcha: The mask ******** is eight characters and counts the 0x prefix, so the answer is six hex digits. Zero-padded forms such as 0x0042800a are rejected.

Command and Control

Compiled AutoIt binaries carry their script as a resource, so decompile statically instead of reading strings. autoit-ripper extracted it first try into script.au3. The remote content is fetched with an InetRead call, and the domain is in that call’s URL.

autoit-ripper evidence/sample work/autoit/

Tip: If the default decoder fails, autoit-ripper takes --ea EA06 or --ea EA05 for older AutoIt versions.

Defense Evasion

In the recovered script, search for BinaryToString. It is handed a 0x... hex literal, which AutoIt decodes to ASCII at runtime. Decoding 0x3A5C57696E646F77735C53797374656D33325C gives the path fragment. The drive letter is not part of the encoded string, which matches the shape of the format mask.

grep -n 'BinaryToString' work/autoit/script.au3

Search the same script for DllCall. The call goes through CallWindowProcW, which is exported by user32.dll, and that DLL name is the first argument.

grep -n 'DllCall' work/autoit/script.au3

Attack Summary

Phase	Action
Execution	Executable carries a compiled AutoIt script as its payload
Command and Control	Script fetches remote content from an external domain with InetRead
Defense Evasion	A system path is stored as a hex string and decoded at runtime
Execution	Script calls CallWindowProcW in user32.dll through DllCall

IOCs

Type	Value
MD5	5e53b40cf972f4eb08990999ce17c5c8
Domain	office-cleaner-commander[.]com
Path fragment (decoded from hex)	:\Windows\System32\
DLL	user32.dll
PE compile time	2020-02-26 21:41:13

MITRE ATT&CK

Technique	ID	Description
Command and Scripting Interpreter: AutoIt	T1059.010	Payload is a compiled AutoIt script
Obfuscated Files or Information	T1027	System path hidden as a hex literal
Ingress Tool Transfer	T1105	InetRead pulls content from a remote domain
Native API	T1106	DllCall into user32.dll

Defender Takeaways

An AutoIt binary hides its logic behind an ordinary PE. Hashing and header review say little, since the entropy and section layout look like any packed executable. Decompiling the script resource with autoit-ripper takes seconds and exposes the real behaviour, so make it a standard first step for any sample flagged as AutoIt.

Hex-encoded strings are cheap to decode and worth hunting for. BinaryToString fed with a 0x... literal is a pattern that string searches for the plain path would miss. Search recovered scripts for BinaryToString, Execute and DllCall before reading anything else.

The recovered domain is the pivot for network detection. Block or alert on office-cleaner-commander[.]com and hunt for AutoIt processes making HTTP requests, since the script performs its download from inside the interpreter.

Conclusion

The sample turned out to be an AutoIt script that reaches out to a remote domain and whose behaviour was entirely recoverable without running it: one decompile exposed the domain, the obfuscated path and the DLL call. Static decompilation beats header triage for this family.