ScanMalware.com
WebAssembly module
API
This view is built from:
Module analysis/api/v1/wasm/4a6b41535187a63e308203eee2e04911d66d7611571d6cd4746eabc1b624d50aDecompiled code/api/v1/wasm/4a6b41535187a63e308203eee2e04911d66d7611571d6cd4746eabc1b624d50a/code

4a6b41535187a63e308203eee2e04911d66d7611571d6cd4746eabc1b624d50a

Known library: adobe-pdf-engineDense data
Download .wasmSearch scans with this module

The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.

At a glance

What it is
Known library: adobe-pdf-engine.
Names it came with
File name: text-zce (2 sites). Its build and the addresses it came from say so; whoever builds a module chooses these, so they are hints.
How it was built
Not named in the module.
What it can do
None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
Where we saw it
On 11 public scans, 2026-10-16 to 2026-10-22.
Findings
Dense data. Leads, not verdicts: legitimate modules show these too.
Size
9.3 MiB
First seen
2026-10-16
Last seen
2026-10-22
Public scans
11
Functions
18248
Imports
68
Exports
16
Data segments
3979

Analysis limits

Only its first 2,000 strings were read.

How it was built

The module names no language, compiler or build tool. Release builds often strip this information, and hand-written modules usually lack it.

Hashing and cipher code

Algorithms recognised from their published constants, tables and rotation amounts: SHA-1. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.

  • function 2027SHA-1 · its rotation amounts
  • function 3344SHA-1 · constants in its code
  • function 6064SHA-1 · constants in its code

Decompiled code

18,233 of 18,248 functions decompiled to C-like pseudocode; 67 more are imported from the page.

  • 15 of 18,248 functions could not be decompiled.

Beyond WebAssembly 1.0: Exception handling (6,632 functions).

Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.

FunctionSizeBlocksComplexityNotes
No functions match.

File layout

WebAssembly binary format version 1, core module, 13 sections (1 custom).

SectionOffsetSizeItems
type0x82.2 KiB234
import0x8fe437 bytes68
function0xab317.9 KiB18,248
table0x526511 bytes1
tag0x52707 bytes
global0x527721 bytes3
export0x528c96 bytes16
start0x52ec4 bytes
element0x52f034.6 KiB1
datacount0xdd414 bytes
code0xdd457.8 MiB18,248
data0x7d1af51.5 MiB3,979
custom: build_id0x95951732 bytes
Memory
256 pages (16.0 MiB), up to 32,768 pages (2.0 GiB), imported from the page as a.a
Table
17,208 entries, up to 17,208 entries, funcref
Start function
function 11868, which runs as soon as the module is loaded
Globals
3
Element segments
1
Declared data segments
3,979
Exception tags
2
Function names
none (names were stripped)
Build ID
2e805195ff434c841a417faf11600de867adab42

Data segments

Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 3,979 segments, 1.5 MiB in all. The chart shows 72: the first 64 and every encrypted or compressed one.

3,907 segments not drawn (1.1 MiB)02468Segment 0: 115,366 bytes, 5.45 bits per byteSegment 1: 1,267 bytes, 5.09 bits per byteSegment 2: 160 bytes, 4.25 bits per byteSegment 3: 99 bytes, 3.4 bits per byteSegment 4: 85 bytes, 3.24 bits per byteSegment 5: 39 bytes, 3.34 bits per byteSegment 6: 292 bytes, 4.76 bits per byteSegment 7: 231 bytes, 4.96 bits per byteSegment 8: 310 bytes, 5.09 bits per byteSegment 9: 67 bytes, 3.31 bits per byteSegment 10: 469 bytes, 5.09 bits per byteSegment 11: 132 bytes, 4.33 bits per byteSegment 12: 103 bytes, 4.57 bits per byteSegment 13: 21 bytes, 3.4 bits per byteSegment 14: 228 bytes, 4.48 bits per byteSegment 15: 21 bytes, 3.27 bits per byteSegment 16: 163 bytes, 4.77 bits per byteSegment 17: 176 bytes, 4.49 bits per byteSegment 18: 4,643 bytes, 4.6 bits per byteSegment 19: 4,295 bytes, 5.44 bits per byteSegment 20: 13,798 bytes, 5.18 bits per byteSegment 21: 1,413 bytes, 4.7 bits per byteSegment 22: 166 bytes, 1.72 bits per byteSegment 23: 5 bytes, 1.37 bits per byteSegment 24: 202 bytes, 2.59 bits per byteSegment 25: 313 bytes, 3.02 bits per byteSegment 26: 132 bytes, 1.93 bits per byteSegment 27: 61 bytes, 1.6 bits per byteSegment 28: 274 bytes, 1.86 bits per byteSegment 29: 112 bytes, 1.48 bits per byteSegment 30: 418 bytes, 1.84 bits per byteSegment 31: 8 bytes, 1.55 bits per byteSegment 32: 141 bytes, 1.48 bits per byteSegment 33: 37 bytes, 1.47 bits per byteSegment 34: 18 bytes, 1.12 bits per byteSegment 35: 4 bytes, 0.81 bits per byteSegment 36: 41 bytes, 1.55 bits per byteSegment 37: 16 bytes, 1.5 bits per byteSegment 38: 93 bytes, 1.56 bits per byteSegment 39: 34 bytes, 2.03 bits per byteSegment 40: 120 bytes, 1.71 bits per byteSegment 41: 45 bytes, 1.31 bits per byteSegment 42: 9 bytes, 1.45 bits per byteSegment 43: 17 bytes, 0.95 bits per byteSegment 44: 27 bytes, 1.19 bits per byteSegment 45: 54 bytes, 1.51 bits per byteSegment 46: 26 bytes, 1.55 bits per byteSegment 47: 7 bytes, 1.15 bits per byteSegment 48: 31 bytes, 1.38 bits per byteSegment 49: 66 bytes, 1.95 bits per byteSegment 50: 108 bytes, 1.34 bits per byteSegment 51: 281 bytes, 1.55 bits per byteSegment 52: 217 bytes, 1.74 bits per byteSegment 53: 62 bytes, 1.86 bits per byteSegment 54: 10,894 bytes, 6.05 bits per byteSegment 55: 196 bytes, 4.94 bits per byteSegment 56: 17 bytes, 0.95 bits per byteSegment 57: 52,663 bytes, 5.28 bits per byteSegment 61: 69 bytes, 0.56 bits per byteSegment 677: 121,743 bytes, 7.67 bits per byteSegment 2928: 51,862 bytes, 7.76 bits per byteSegment 2930: 9,129 bytes, 7.76 bits per byteSegment 2950: 5,930 bytes, 7.57 bits per byteSegment 2951: 6,780 bytes, 7.63 bits per byteSegment 2953: 11,437 bytes, 7.63 bits per byteSegment 2954: 15,821 bytes, 7.65 bits per byteSegment 2966: 24,771 bytes, 7.52 bits per byte
data segment encrypted or compressed 3,907 segments not drawn 7.5 bits per byteHeight: bits per byte. Width: share of all the data.
  • Segment 677: 121,743 bytes at 7.67 bits per byte
  • Segment 2928: 51,862 bytes at 7.76 bits per byte
  • Segment 2930: 9,129 bytes at 7.76 bits per byte
  • Segment 2950: 5,930 bytes at 7.57 bits per byte
  • Segment 2951: 6,780 bytes at 7.63 bits per byte
  • Segment 2953: 11,437 bytes at 7.63 bits per byte
  • Segment 2954: 15,821 bytes at 7.65 bits per byte
  • Segment 2966: 24,771 bytes at 7.52 bits per byte

Imports (68)

  • a.b
  • a.c
  • a.d
  • a.e
  • a.f
  • a.g
  • a.h
  • a.i
  • a.j
  • a.k
  • a.l
  • a.m
  • a.n
  • a.o
  • a.p
  • a.q
  • a.r
  • a.s
  • a.t
  • a.u
  • a.v
  • a.w
  • a.x
  • a.y
  • a.z
  • a.A
  • a.B
  • a.C
  • a.D
  • a.E
  • a.F
  • a.G
  • a.H
  • a.I
  • a.J
  • a.K
  • a.L
  • a.M
  • a.N
  • a.O
  • a.P
  • a.Q
  • a.R
  • a.S
  • a.T
  • a.U
  • a.V
  • a.W
  • a.X
  • a.Y

Exports (16)

Text it passes to the page

Fixed text the module hands to the page's JavaScript when it calls an import, read from the module file. Imports that reach the network, run code or change the page come first; web addresses are shown as their host.

ImportText
a.Dfloa
a.EATEK
a.EATEM
a.Flong lon
a.Funsigned
a.Rvoid
a.Sstd::string
a.Ubool
a.bvppi
a.bvppp
a.bctrlKey
a.bmetaKey
a.baltKey
a.bshiftKey
a.bisRepeat
a.brightClick
a.bclickCount
a.bvppd
a.bclientX
a.bclientY
a.bcanvasX
a.bcanvasY
a.bcmdKey
a.bactionKey
a.bisBarrelButtonPressed
a.babsoluteX
a.babsoluteY
a.bthickness
a.bstringIndex
a.bstringLength

Showing 30 of 396.

In our sandbox

  • Produced 27 strings at run time, listed below.

Strings it produced at run time

Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host. Showing 26 of 27.

  1. 22CTOutOfMemoryException
  2. g,10Type1Parse
  3. ]Z`c^_Ya[\b
  4. yPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyP
  5. N6icu_7717ResourceDataValueE
  6. N3SLO1…0EEE
  7. GHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
  8. `abcdefghijklmn
  9. 12WRThaiScript
  10. 15WRLaotianScript
  11. 16WRGurmukhiScript
  12. 16WRGujaratiScript
  13. 13WROriyaScript
  14. 14WRTeluguScript
  15. 15WRKannadaScript
  16. 13WRKhmerScript
  17. WRS_INFO IP ID:<AdobeIP#A0001584>
  18. Fasttext
  19. 9tBar_AE
  20. 2de_DE@2006
  21. s~ako_KR
  22. >/anl_NL
  23. 2=Xsat_IN
  24. -4F61-9;
  25. yJq3Gujr
  26. F61-99CD

Checks we ran

  • Threat-feed matches: none
  • Names of mining software or pools: none
  • CryptoNight mining structure: not found
  • Hashing or cipher loops: none
  • Known hashing or cipher algorithms: SHA-1
  • Encrypted or compressed data: 8 blocks, 241.7 KiB (15.7% of its data)
  • JavaScript stored inside: none
  • Other modules inside: none
  • Imports that read browser or page details: none
  • Function names: removed (usual in release builds)

Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.

Seen on 11 public scans

PageTitleSeenHow it got there
new.express.adobe.comAdobe Express2026-10-22Downloaded as a file
new.express.adobe.comAdobe Express2026-10-22Downloaded as a file
new.express.adobe.comAdobe Express2026-10-21Downloaded as a file
new.express.adobe.comAdobe Express2026-10-21Downloaded as a file
new.express.adobe.comAdobe Express2026-10-21Downloaded as a file
new.express.adobe.comAdobe Express2026-10-21Downloaded as a file
new.express.adobe.comAdobe Express2026-10-20Downloaded as a file
new.express.adobe.comAdobe Express2026-10-17Downloaded as a file
new.express.adobe.comAdobe Express2026-10-17Downloaded as a file
new.express.adobe.comMMTrade.se2026-10-17Downloaded as a file
new.express.adobe.comAdobe Express2026-10-16Downloaded as a file