0f9ce15381dd36741f2b545982f9baa2c4b9cc123be519aae26fe39368dea5bc
The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.
At a glance
- What it is
- Runs as part of alibaba-punish-challenge.
- Names it came with
- From g.alicdn.com. Its build and the addresses it came from say so; whoever builds a module chooses these, so they are hints.
- How it was built
- Not named in the module.
- What it can do
- None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
- Where we saw it
- On 2 public scans, 2026-10-17 to 2026-10-19.
- Findings
- Nothing flagged by the checks below.
- Size
- 20.5 KiB
- First seen
- 2026-10-17
- Last seen
- 2026-10-19
- Public scans
- 2
- Functions
- 26
- Imports
- 4
- Exports
- 10
- Data segments
- 17
How it was built
The module names no language, compiler or build tool. Release builds often strip this information, and hand-written modules usually lack it.
Decompiled code
26 of 26 functions decompiled to C-like pseudocode; 4 more are imported from the page.
Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.
| Function | Size | Blocks | Complexity | Notes |
|---|---|---|---|---|
| No functions match. | ||||
File layout
WebAssembly binary format version 1, core module, 10 sections.
| Section | Offset | Size | Items |
|---|---|---|---|
| type | 0x8 | 79 bytes | 12 |
| import | 0x57 | 27 bytes | 4 |
| function | 0x72 | 29 bytes | 26 |
| table | 0x8f | 7 bytes | 1 |
| memory | 0x96 | 8 bytes | 1 |
| global | 0x9e | 10 bytes | 1 |
| export | 0xa8 | 43 bytes | 10 |
| element | 0xd3 | 9 bytes | 1 |
| code | 0xdc | 19.9 KiB | 26 |
| data | 0x505f | 465 bytes | 17 |
- Memory
- 256 pages (16.0 MiB), up to 256 pages (16.0 MiB)
- Table
- 2 entries, up to 2 entries, funcref
- Globals
- 1
- Element segments
- 1
- Function names
- none (names were stripped)
Data segments
Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 17 segments, 358 bytes in all.
In our sandbox
- Produced 5 strings at run time, listed below.
Strings it produced at run time
Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host.
- 9aee24cd97be07b227d3b2c776f6f615
- YrkfnsvIvfGYhhQq
- l)|(null)|(null)|(null)|(null)|(null)|(null)|YrkfnsvIvfGYhhQq|0
- 4cd97be07b227d3b2c776f6f615:0|0|(null)|(null)|(null)|(null)|(null)|(null)|(null)|YrkfnsvIvfGYhhQq|0:YrkfnsvIvfGYhhQq:0:(
- 78623a…3a30
Checks we ran
- Threat-feed matches: none
- Names of mining software or pools: none
- CryptoNight mining structure: not found
- Hashing or cipher loops: none
- Known hashing or cipher algorithms: none recognised
- Encrypted or compressed data: none
- JavaScript stored inside: none
- Other modules inside: none
- Imports that read browser or page details: none
- Function names: removed (usual in release builds)
Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.
Seen on 2 public scans
| Page | Title | Seen | How it got there |
|---|---|---|---|
| club13mm.ru | Сlub-гаджет - Гаджеты и программы: обзоры, новости, инструкции | 2026-10-19 | Built by a script at run time |
| 12bdbdbxb-dpspvb0ls4et.edgeone.dev | Open New Tab | 2026-10-17 | Built by a script at run time; Downloaded as a file |