4eb7b21e7cf87d2a5a0bb76380e9b758e959fd286943ce2209ea362b93cfee2d
The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.
At a glance
- What it is
- Known library: Cap proof-of-work captcha.
- How it was built
- Written in Rust. wasm-bindgen connects it to the page's JavaScript.
- What it can do
- None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
- Where we saw it
- On 2 public scans, 2026-10-05 to 2026-10-10.
- Findings
- Hashing or cipher loops. Leads, not verdicts: legitimate modules show these too.
- Size
- 35.2 KiB
- First seen
- 2026-10-05
- Last seen
- 2026-10-10
- Public scans
- 2
- Functions
- 63
- Imports
- 1
- Exports
- 6
- Data segments
- 2
How it was built
Written in Rust. wasm-bindgen connects it to the page's JavaScript.
- Language
- RustThe Rust compiler (rustc) left its name in the module.
- Connects to JavaScript
- wasm-bindgenRust's bridge to JavaScript. It writes glue code on both sides, so the module can call page functions such as fetch or the DOM, and the page can call the module.
- Rewritten after compiling
- walrusA library for rewriting compiled modules. wasm-bindgen runs it on every build, so it comes with wasm-bindgen and says nothing more about the module.
Read from text inside the module (its build metadata and paths the compiler left) and from its import and export names. Whoever builds a module can change or remove these, so treat them as hints. They say how a module was made, not what it does.
What it is made of
1 Rust crate from crates.io, with the versions it was built with:
Build tools and versions it names:
- Rust
- rustc 1.86.0 (05f9846f8 2025-03-31)
- walrus 0.23.3
- wasm-bindgen 0.2.100
Read from text the build left in the module: source paths, build metadata and .NET metadata. Whoever builds a module can change or remove it, so treat it as a hint.
Hashing and cipher code
Algorithms recognised from their published constants, tables and rotation amounts: SHA-256. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.
- function 1SHA-256 · its rotation amounts
- solve_powSHA-256 · a table it reads
Decompiled code
63 of 63 functions decompiled to C-like pseudocode; 1 more is imported from the page.
Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.
| Function | Size | Blocks | Complexity | Notes |
|---|---|---|---|---|
| No functions match. | ||||
File layout
WebAssembly binary format version 1, core module, 12 sections (2 custom).
| Section | Offset | Size | Items |
|---|---|---|---|
| type | 0x8 | 83 bytes | 12 |
| import | 0x5b | 41 bytes | 1 |
| function | 0x84 | 66 bytes | 63 |
| table | 0xc6 | 11 bytes | 2 |
| memory | 0xd1 | 5 bytes | 1 |
| global | 0xd6 | 11 bytes | 1 |
| export | 0xe1 | 106 bytes | 6 |
| element | 0x14b | 35 bytes | 1 |
| code | 0x16e | 29.9 KiB | 63 |
| data | 0x792b | 4.7 KiB | 2 |
| custom: producers | 0x8c03 | 114 bytes | |
| custom: target_features | 0x8c75 | 75 bytes |
- Memory
- 17 pages (1.1 MiB), no upper limit
- Table 0
- 28 entries, up to 28 entries, funcref
- Table 1
- 128 entries, no upper limit, externref
- Globals
- 1
- Element segments
- 1
- Function names
- none (names were stripped)
- Target features
- +mutable-globals +sign-ext +reference-types +multivalue
Data segments
Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 2 segments, 4.7 KiB in all.
Imports (1)
Imports from wbg are wasm-bindgen glue. Each __wbg_… import calls one JavaScript function in the page, and its name says which (__wbg_fetch_… calls fetch). The __wbindgen_… imports are wasm-bindgen's own helpers for strings, errors and memory.
- wbg.__wbindgen_init_externref_table
Exports (6)
Scripts that carry or load it
- www.shinservice.ru carries it as text; the script is minified or bundled.
- www.shinservice.ru carries it as text; the script is minified or bundled.
From public scans. A script loads a module when it fetches or compiles it.
In our sandbox
- Produced 1 string at run time, listed below.
Strings it produced at run time
Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host.
- EmptyInvalidDigitPosOverflowNegOverflowZero
Checks we ran
- Threat-feed matches: none
- Names of mining software or pools: none
- CryptoNight mining structure: not found
- Hashing or cipher loops: 1 function (common in codecs and captchas)
- Known hashing or cipher algorithms: SHA-256
- Encrypted or compressed data: none
- JavaScript stored inside: none
- Other modules inside: none
- Imports that read browser or page details: none
- Function names: removed (usual in release builds)
Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.
Seen on 2 public scans
| Page | Title | Seen | How it got there |
|---|---|---|---|
| www.shinservice.ru | ШИНСЕРВИС - интернет-магазин шин, дисков и АКБ в Москве и области | 2026-10-10 | Embedded in a script |
| www.shinservice.ru | ШИНСЕРВИС - интернет-магазин шин, дисков и АКБ в Москве и области | 2026-10-05 | Embedded in a script |