However, the function and variable names are obfuscated:įurthermore, most of the string literals are stored as encrypted strings and they are decrypted during run-time in function isdmecxgijvxvjlgiriw ( ). The decompilation process was flawless and it generated a file with 40 user functions. Normally, we would use our retargetable decompiler for code analysis however, there exists another decompiler that is focused directly on AutoIt executables – Exe2Aut(we used version 0.10).

However, in our case, the script is stored in the manifest resource (type 24) of the executable file.īy the preliminary analysis, we can conclude that this sample is not packed (e.g. This code is usually stored at the end of the executable file in the so-called overlay. The pre-compiled code is interpreted by the interpreter during run-time. This script is not stored as plain text, but as a pre-compiled code, which can be detected via sequence AU3!EA06. In this case, the resulting executable file contains an interpreter of the user’s AutoIt script. AnalysisĮxecutable files generated via the official Aut2Exe application or via the online compiler are not compiled into a native executable code, as we are used to in languages like C. According to the recent research, the most popular programming languages are still C, Java, and PHP. This is interesting because AutoIt does not belong in a group of the most popular programming languages. Those are probably the primary reasons why AutoIt is heavily misused by malware writers in recent years, see comments from our colleagues 1, 2. In other words, it is very easy to distribute such applications. Finally, the AutoIt scripts can be compiled into stand-alone executables with no DLL dependencies. The main advantage of this language is its flexibility and support of rapid application development by using built-in functions. The syntax of the AutoIt language is similar to BASIC. The author of this malware simply reused and connected the existing modules together and created a tougher-to-analyze sample. RunExeFromMemory, RunBinary, SetDebugPrivilege, AES. The implementation of most of these techniques is publicly available for several years directly in the AutoIt language, e.g. The malware has been developed in the not-so-common AutoIt scripting language. This sample is interesting because it uses several different layers of its protection – obfuscation, encoding & encryption, code hiding, proactive defense against AV software, and other similar techniques. Its goal is to steal credentials from a running web browser.

In this article, we focus on analysis of a 32-bit WinPE sample with MD5 sum C8F3C24F123D851F57AFF21958ADAC76.

Decompiling an autoit exe