> Technique · K30ZWMBJJ String Obfuscation_

~/packetpursuit $ cat /intel/techniques/k30zwmbjj-string-obfuscation.md

typetechniquefamilyunclassified-autoit-compiledconfidencehighcreated2026-06-28updated2026-06-28obfuscationautoitevasionresearch-target

K30ZWMBJJ String Obfuscation

Overview

A custom string-obfuscation function found in the decompiled AutoIt script of the b017d189 sample. It protects shellcode-staging API names and file paths from static string extraction. The technique combines a permutation table with a trivial XOR key, making it recoverable with minimal effort but sufficient to defeat naive string-matching.

What It Does

  1. Takes a plaintext string and a hardcoded permutation lookup table.
  2. Permutes each character through the table.
  3. XORs the permuted bytes with a two-byte key ("AA" in the observed sample).
  4. Stores the result as a byte array in the compiled script.
  5. At runtime, reverses the process to recover the original API name or path.

Detection / Fingerprint

Look for AutoIt scripts containing:

  • A function named K30ZWMBJJ or similar random alphanumeric identifier (e.g., TIYHOWEDON, L300CM2V, O30MJJHT)
  • A long integer array initialized with values in the 48–122 ASCII range
  • A short two-character XOR key ("AA", "WH", etc.)
  • Calls to DllCall using the decoded output for kernel32.dll, VirtualAlloc, VirtualProtect, etc.

Implementation Pattern Observed

Func K30ZWMBJJ($data)
    Local $table[256] = [...]  ; permutation lookup
    Local $key = "AA"
    Local $out = ""
    For $i = 0 To UBound($data) - 1
        $out &= Chr(BitXOR(Asc($table[$data[$i]]), Asc(StringMid($key, Mod($i, 2) + 1, 1))))
    Next
    Return $out
EndFunc

Reproduce on Your Own VMs

  1. Install AutoIt v3.3.8.1 on a Windows VM.
  2. Write a script that defines a permutation table and a two-byte XOR key.
  3. Encode a target string (e.g., "VirtualAlloc") through the table + XOR.
  4. Decode at runtime and call DllCall with the recovered string.
  5. Compile with Aut2Exe to a single-file PE.

Verification: Run strings on the compiled PE — the plaintext "VirtualAlloc" should not appear. FLOSS or autoit-ripper decompilation should reveal the K30ZWMBJJ-like function and the integer array.

Defensive Countermeasures

  • YARA rules targeting compiled AutoIt scripts with large integer arrays and short XOR keys.
  • Static analysis pipelines that auto-decompile AutoItSC binaries and extract decoded strings.
  • Behavioral detection: DllCall to kernel32.dll with dynamically resolved API names from AutoIt processes.

Pages Where Observed

  • b017d189 — K30ZWMBJJ with key "AA"^[/intel/analyses/b017d1897d3c5b5c51f02fafcbe48700943ebe0921c1c881d4f7ea37fe1eefdc.html]
  • aa4d237c — Caesar-5 obfuscation O30MJJHT, XOR key "WH"^[/intel/analyses/aa4d237c7a9b4ec7915c582ad703c886422d59ceb40ded57307d7da15ec9bfc8.html]
  • accd2ccd — Caesar-3 obfuscation L300CM2V^[/intel/analyses/accd2ccd2be48b4303154bb87f87d0d6897441c18ca7b16b22fbaa8b68bbacbb.html]
  • a8beee89 — TIYHOWEDON junk-token stripping^[/intel/analyses/a8beee89eb72948b3fd255c6a1f5bab0300161aa0e32ba0aaffe5653b75111d0.html]

Related Concepts