0fc87cb0276dc1f9f8dbb28bedf200f755eea781317a390f0cd1ece92b5f8360
The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.
At a glance
- What it is
- Not identified. Its build does not name it and it matches no library we know.
- Names it came with
- From armor.ltwebstatic.com. Its build and the addresses it came from say so; whoever builds a module chooses these, so they are hints.
- How it was built
- Not named in the module.
- What it can do
- None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
- Where we saw it
- On 1 public scan, 2026-10-22.
- Findings
- Nothing flagged by the checks below.
- Size
- 68.9 KiB
- First seen
- 2026-10-22
- Last seen
- 2026-10-22
- Public scans
- 1
- Functions
- 73
- Imports
- 21
- Exports
- 10
- Data segments
- 18
How it was built
The module names no language, compiler or build tool. Release builds often strip this information, and hand-written modules usually lack it.
Hashing and cipher code
Algorithms recognised from their published constants, tables and rotation amounts: AES. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.
- function 40AES · a table it reads
- EAES · a table it reads
- DAES · a table it reads
Decompiled code
73 of 73 functions decompiled to C-like pseudocode; 21 more are imported from the page.
Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.
| Function | Size | Blocks | Complexity | Notes |
|---|---|---|---|---|
| No functions match. | ||||
File layout
WebAssembly binary format version 1, core module, 10 sections.
| Section | Offset | Size | Items |
|---|---|---|---|
| type | 0x8 | 166 bytes | 27 |
| import | 0xae | 129 bytes | 21 |
| function | 0x12f | 76 bytes | 73 |
| table | 0x17b | 7 bytes | 1 |
| memory | 0x182 | 8 bytes | 1 |
| global | 0x18a | 11 bytes | 1 |
| export | 0x195 | 43 bytes | 10 |
| element | 0x1c0 | 12 bytes | 1 |
| code | 0x1cc | 66.0 KiB | 73 |
| data | 0x109a9 | 2.4 KiB | 18 |
- Memory
- 256 pages (16.0 MiB), up to 256 pages (16.0 MiB)
- Table
- 5 entries, up to 5 entries, funcref
- Globals
- 1
- Element segments
- 1
- Function names
- none (names were stripped)
Data segments
Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 18 segments, 2.3 KiB in all.
Scripts that carry or load it
- armor.ltwebstatic.com carries it as text; the script is lightly obfuscated.
From public scans. A script loads a module when it fetches or compiles it.
In our sandbox
- Produced 7 strings at run time, listed below.
Strings it produced at run time
Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host.
- 0123456789abcdefk
- qqqqqqqqq0
- c24761a4f4f3bc3b70d6cb202604ba98
- qqqqqqqqq0c2476
- dddddddddddddddd
- ddddddddddddddddddd
- ddddddddddddddddddddddddddddddddddd"
Checks we ran
- Threat-feed matches: none
- Names of mining software or pools: none
- CryptoNight mining structure: not found
- Hashing or cipher loops: none
- Known hashing or cipher algorithms: AES
- Encrypted or compressed data: none
- JavaScript stored inside: none
- Other modules inside: none
- Imports that read browser or page details: none
- Function names: removed (usual in release builds)
Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.
Seen on 1 public scan
| Page | Title | Seen | How it got there |
|---|---|---|---|
| www.shein.tw | Women's & Men's Clothing, Shop Online Fashion | SHEIN | 2026-10-22 | Built by a script at run time; Embedded in a script |