You are commenting using your Twitter account.There is no decompiler for any version of exe created by a version after 3. You are commenting using your Google account. So, when analyzing the compiled binary within a debugger, we now know to set a breakpoint on this function that we find interesting. Depending on the complexity, you could attempt to manually deobfuscate the script by replacing variable names, manually concatenating values, etc…. More often than not, the decompiled script will be heavily obfuscated. Almost instantaneously, the decompiled source code is displayed in the application Figure 12 and the plain-text script is dumped to disk as a. If you are dealing with a compiled scriptsimply drag-and-drop the AutoIt Interpreter executable i. Bottom line, any time you have the opportunity to obtain and analyze the original source code, you take it! Exe2Aut is an application that enables simple drag-and-drop decompilation of compiled AutoIt scripts. With the standalone executable, the malicious payload will be presented as a single. This is just how this particular miscreant decided to trick the victim into running their malware. Note that the method for getting the unsuspecting victim to execute the malicious AutoIt payload will likely differ between samples. As expected, the malicious code is executed by passing in the compiled AutoIt Script WinddowsUpdater. We can see how this malware is executed by inspecting the specified targets of the shortcut files also present within the same directory Figure 6. The contents of this particular script is shown in Figure 5. In the example provided in Figure 1, this would be WinddowsUpdater. In order for it to facilitate malicious code execution, the interpreter must be fed a script. The AutoIt interpreter, by itself, is benign. Figure 4 shows that the hash for WinddowsUpdater. Third, you can compare the hash of the file in question to the hash of the actual AutoIt3.

Second, if you inspect the version information for this file within PEStudio, you will see multiple references to AutoIt medium fidelity Figure 3. The first sign that is the case is the icon for the file, which is the AutoIt icon extremely low fidelity Figure 2.

Here is an example of one such malicious sample. I will, however, attempt to provide you with a starting point by showing you how to get from a compiled AutoIt binary to a plain-text script. Unfortunately, there are way too many different ways that malware authors have leveraged AutoIt for me to write a one-analysis-fits-all post. AutoIt is yet-another-development-language that malware authors leverage to create and obfuscate their malware.

Decompiling an autoit exe