AutoIt Delimiter + Reverse String Obfuscation

A simple but effective string-obfuscation pattern observed in AutoIt-compiled malware. The script encodes sensitive strings (API names, DLL names, payload data) by inserting a fixed delimiter between each character, then reverses the entire string. At runtime, the delimiter is stripped and the string is reversed back to plaintext.

Detection / Fingerprint

• AutoIt script contains a helper function that calls StringReplace($s, "<delimiter>", "") followed by a character-by-character reversal loop.
• Common delimiters observed: 6504 (this sample), x, 0.
• The encoded strings are long, repetitive, and contain no semantic content until decoded.

Implementation Pattern

Func B30VDMCF($E30QROYZ7)
    Local $T317S5RVWE = Y32ZJAMUI($E30QROYZ7, "6504", "")
    Local $G33Q06IFD = P31T9DO($T317S5RVWE)
    Return $G33Q06IFD
EndFunc

Func P31T9DO($Z36C50O)
    Local $T317S5RVWE = ""
    Local $A38BWZGWO5 = StringLen($Z36C50O)
    For $Y3130UGAUZP = $A38BWZGWO5 To 1 Step +4294967295
        $T317S5RVWE &= StringMid($Z36C50O, $Y3130UGAUZP, 1)
    Next
    Return $T317S5RVWE
EndFunc

Reproduce on Your Own VMs

1. Write an AutoIt script with a sensitive string, e.g. "kernel32".
2. Encode: insert delimiter 6504 between each character → "k6504e6504r6504n6504e6504l650432".
3. Reverse the entire string.
4. At runtime, strip 6504 and reverse back.

Defensive Countermeasures

• Static strings analysis: look for long strings with repeating 4-byte patterns (6504 in this case).
• Behavioral: AutoIt processes performing VirtualAlloc with 0x40 (PAGE_EXECUTE_READWRITE) are suspicious.

Pages Where Observed

• formbook — primary family using this technique
• a4cb4c76 — sample analysis (/intel/analyses/a4cb4c76933ac72570a90a7bb73c6dc6cdc791db10697aa10bf70dec8835e53c.html)