Solution to AutoHotkey Screenlocker

rifteyy
September 24, 2026
22
Analysis Task
SHA256: d2e98409dca36f58a4b71d631ea941bb5f5153ece976935e95a09764cc6a98f9
Goal: Figure out the password of this screenlocker and check if there are any other ways …
Difficulty: easy

Initial triage

I decided to use DetectItEasy on the sample first:

1

And this revealed the file was a compiled AutoHotKey script. I searched on possibilities of extracting the original AHK script from it, and found this Reddit comment that said:

If the executable is "compiled" with AHK_H and the source code is encrypted you're out of luck.
With Resource Hacker you can have the script as a resource. If the .exe is compressed you only need to decompress or just the Payload Decompiler is been around for ages.

I have also used Portex Analyzer which told me the same tip:
2

Script extraction

So I decided to open Resource Hacker, opened the RCData tab and there was the AHK script:
3

I copied and pasted the script in NP++ and discovered the password is 7331. :D
4