6ddv8 Delimiter Hex-Split Obfuscation

An AutoIt obfuscation variant where hex-encoded payloads are split across hundreds of string-concatenation lines ($VAR &= "..."), each fragment polluted with the fixed five-character delimiter "6ddv8". A helper function strips the delimiter at runtime before hex-decoding.

Detection / Fingerprint

• AutoIt script with a global variable built via hundreds of $VAR &= "..." lines.
• The payload string is prefixed with 0x (hex marker).
• The fixed delimiter "6ddv8" is inserted between every two hex digits.
• A helper function (e.g., BZAADLRV) uses StringInStr + StringReplace or StringTrimLeft/StringMid to remove the delimiter.

Implementation Pattern

Global $QBCRBMYGX = "6ddv806ddv8x6ddv85..."
$QBCRBMYGX &= "6ddv826ddv8f6ddv89..."
; ... 70+ lines
$QBCRBMYGX = BZAADLRV($QBCRBMYGX, "6ddv8", "")
; result: "0x558bec81ec..." → hex-decoded shellcode

The BZAADLRV function in sample c3985bb5 wraps StringReplace($JICBQNR, $KMTOSNGREW, $EHDVFGZYVU) where $KMTOSNGREW is the literal "6ddv8" and $EHDVFGZYVU is an empty string. ^[script.au3:2256]

Defensive Countermeasures

• Script-aware deobfuscation: extract all &= lines, concatenate quoted contents, strip "6ddv8", then bytes.fromhex().
• Behavioral: AutoIt processes creating RWX memory (VirtualProtect with 0x40) are suspicious.

Pages Where Observed

• unclassified-autoit-compiled — c3985bb5 primary sample