Can You Trust Your AutoIT Decompiler?
Summary: Unit 42 researchers found that the Exe2Aut decompiler injects a DLL into the target binary and hooks the bytecode execution function, while MyAut2Exe statically extracts and unpacks the bytecode resource without the embedded interpreter. They built a proof-of-concept AutoIt executable with three bytecodes in the .rsrc section that tricks Exe2Aut via a 70-byte assembly shellcode checking for the injected UPX-packed DLL and tricks MyAut2Exe by placing a decoy script at a lower offset than the real one.
Bottom line: A reverse engineer who trusts a decompiler's output can be handed a decoy script while the real malicious code runs, and the trick works against both common AutoIT decompilers - only dynamic sandbox analysis was unaffected in the researchers' testing.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026