P3059Y1DO Stride-3 Decimal String Obfuscation

Overview

A custom string-obfuscation function used by the unclassified-autoit-compiled cluster of AutoItSC droppers. The function iterates over an input string in steps of 3, takes the first two characters of each triple, parses them as decimal integers (Dec() in AutoIt), converts to ASCII (Chr()), and concatenates the result.

Mechanism

Func P3059Y1DO($L30V6AO)
    Local $G321C, $H30K3W = ""
    For $G321C = 1 To StringLen($L30V6AO) Step 3
        $H30K3W &= Chr(Dec(StringMid($L30V6AO, $G321C, 2)))
    Next
    Return $H30K3W
EndFunc

Example decode of 6BR65E6CQ33U32A2ER64P6CY6CX:

• 6B → 107 → k
• R6 → ... (each pair decoded sequentially)

Result: kernel32.dll

Cluster Context

First observed in sample 127c404a (Jul 2024). Similar stride-3 obfuscation has been observed across the unclassified-autoit-compiled cluster with varying function names:

• P3059Y1DO — decimal conversion (this sample)
• S30K9CPG — Caesar-5 + XOR key "06" (sibling 763ae850)
• Z30PER — hex-split interleaved noise (sibling 64b37e90)
• O30MJJHT — Caesar-5 + XOR key "WH" (sibling aa4d237c)
• W30gfpz1 — Caesar-3 hex-string decoder (sibling 498f7bf3)

Detection

• Look for Step 3 in AutoIt decompilation output.
• Look for Dec( combined with StringMid in compiled AutoIt scripts.
• Stride-3 obfuscation produces ciphertexts roughly 1.5× the length of the plaintext.

Related

• autoit-stride3-hex-decoder — hex variant of stride-3 obfuscation
• unclassified-autoit-compiled — parent cluster