ScanMalware.com
WebAssembly module
API
This view is built from:
Module analysis/api/v1/wasm/655cc4de3ab1d63b2558d21cddac1eb8b97fc4077c91f8c4371912b07a12c76cDecompiled code/api/v1/wasm/655cc4de3ab1d63b2558d21cddac1eb8b97fc4077c91f8c4371912b07a12c76c/code

655cc4de3ab1d63b2558d21cddac1eb8b97fc4077c91f8c4371912b07a12c76c

Download .wasmSearch scans with this module

The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.

At a glance

What it is
Not identified. Its build does not name it and it matches no library we know.
How it was built
Not named in the module.
What it can do
None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
Where we saw it
On 2 public scans, 2026-10-11 to 2026-10-23.
Findings
Nothing flagged by the checks below.
Size
277.4 KiB
First seen
2026-10-11
Last seen
2026-10-23
Public scans
2
Functions
871
Imports
59
Exports
16
Data segments
56

How it was built

The module names no language, compiler or build tool. Release builds often strip this information, and hand-written modules usually lack it.

Hashing and cipher code

Algorithms recognised from their published constants, tables and rotation amounts: SHA-256 or BLAKE2s/BLAKE3. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.

  • function 632SHA-256 or BLAKE2s/BLAKE3 · constants in its code

Decompiled code

871 of 871 functions decompiled to C-like pseudocode; 59 more are imported from the page.

Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.

FunctionSizeBlocksComplexityNotes
No functions match.

File layout

WebAssembly binary format version 1, core module, 10 sections.

SectionOffsetSizeItems
type0x8429 bytes52
import0x1b5363 bytes59
function0x320876 bytes871
table0x68c9 bytes1
memory0x6958 bytes1
global0x69d10 bytes1
export0x6a795 bytes16
element0x706878 bytes1
code0xa74172.1 KiB871
data0x2bb05102.6 KiB56
Memory
2 pages (128.0 KiB), up to 32,768 pages (2.0 GiB)
Table
451 entries, up to 451 entries, funcref
Globals
1
Element segments
1
Function names
none (names were stripped)

Data segments

Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 56 segments, 102.2 KiB in all.

02468Segment 0: 13,640 bytes, 5.09 bits per byteSegment 1: 995 bytes, 4.58 bits per byteSegment 2: 16 bytes, 4 bits per byteSegment 3: 23 bytes, 2.49 bits per byteSegment 4: 65 bytes, 2.3 bits per byteSegment 5: 33 bytes, 1.99 bits per byteSegment 7: 21 bytes, 1.28 bits per byteSegment 9: 21 bytes, 1.53 bits per byteSegment 11: 30 bytes, 1.53 bits per byteSegment 12: 14 bytes, 1.2 bits per byteSegment 14: 21 bytes, 1.28 bits per byteSegment 16: 2,521 bytes, 4.34 bits per byteSegment 17: 595 bytes, 3.71 bits per byteSegment 18: 2 bytes, 1 bits per byteSegment 19: 74 bytes, 3.7 bits per byteSegment 20: 255 bytes, 3.19 bits per byteSegment 21: 2 bytes, 1 bits per byteSegment 22: 505 bytes, 2.47 bits per byteSegment 23: 2 bytes, 1 bits per byteSegment 24: 505 bytes, 2.47 bits per byteSegment 25: 193 bytes, 2.99 bits per byteSegment 26: 473 bytes, 2.07 bits per byteSegment 27: 1,174 bytes, 4.32 bits per byteSegment 28: 202 bytes, 4.24 bits per byteSegment 29: 222 bytes, 4.35 bits per byteSegment 30: 190 bytes, 4.28 bits per byteSegment 31: 1,434 bytes, 4.46 bits per byteSegment 32: 154 bytes, 4.54 bits per byteSegment 33: 154 bytes, 4.5 bits per byteSegment 34: 154 bytes, 4.47 bits per byteSegment 35: 1,081 bytes, 2.28 bits per byteSegment 36: 842 bytes, 4.32 bits per byteSegment 37: 50 bytes, 3.86 bits per byteSegment 38: 98 bytes, 3.02 bits per byteSegment 39: 56,312 bytes, 7.25 bits per byteSegment 40: 11,250 bytes, 7.29 bits per byteSegment 41: 11,257 bytes, 7.28 bits per byteSegment 43: 14 bytes, 2.09 bits per byteSegment 45: 5 bytes, 0.72 bits per byteSegment 46: 9 bytes, 2.73 bits per byteSegment 48: 18 bytes, 1.78 bits per byteSegment 52: 11 bytes, 2.05 bits per byteSegment 55: 2 bytes, 1 bits per byte
data segment encrypted or compressed 7.5 bits per byteHeight: bits per byte. Width: share of all the data.

Imports (59)

  • a.a
  • a.b
  • a.c
  • a.d
  • a.e
  • a.f
  • a.g
  • a.h
  • a.i
  • a.j
  • a.k
  • a.l
  • a.m
  • a.n
  • a.o
  • a.p
  • a.q
  • a.r
  • a.s
  • a.t
  • a.u
  • a.v
  • a.w
  • a.x
  • a.y
  • a.z
  • a.A
  • a.B
  • a.C
  • a.D
  • a.E
  • a.F
  • a.G
  • a.H
  • a.I
  • a.J
  • a.K
  • a.L
  • a.M
  • a.N
  • a.O
  • a.P
  • a.Q
  • a.R
  • a.S
  • a.T
  • a.U
  • a.V
  • a.W
  • a.X

Exports (16)

Text it passes to the page

Fixed text the module hands to the page's JavaScript when it calls an import, read from the module file. Imports that reach the network, run code or change the page come first; web addresses are shown as their host.

ImportText
a.hin_yuva
a.hin_00
a.hin_01
a.hin_10
a.hin_11
a.hin_rgba
a.htexture
a.paPosition
a.paTextureCoord
a.pposition

In our sandbox

  • Produced 3 strings at run time, listed below.

Strings it produced at run time

Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host.

  1. infinity
  2. LC_CTYPE
  3. bmf super_resolution_web super_resolution input: alg_type:0 backend:0 scale:0 pool_size:0 max_width:0 max_height:0 libpa

Checks we ran

  • Threat-feed matches: none
  • Names of mining software or pools: none
  • CryptoNight mining structure: not found
  • Hashing or cipher loops: none
  • Known hashing or cipher algorithms: SHA-256 or BLAKE2s/BLAKE3
  • Encrypted or compressed data: none
  • JavaScript stored inside: none
  • Other modules inside: none
  • Imports that read browser or page details: none
  • Function names: removed (usual in release builds)

Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.

Shares code with

Other modules that contain some of the same functions. They are ranked by functions few modules have, so a language's own runtime does not link every module built with it. Shared code often means a shared library or the same developer. It is a lead, not a verdict.

  • 4bde01af…c6b3306.5 MiB · first seen 2026-10-23 · 103 functions in common (35% of this module's, 2% of that one's)
  • 4d0a7c5d…100f866.6 MiB · first seen 2026-10-07 · 95 functions in common (32% of this module's, 2% of that one's)
  • c163375d…bcba535.1 MiB · first seen 2026-10-23 · 94 functions in common (32% of this module's, 2% of that one's)
  • 75c3e7b4…31b9cb1.4 MiB · first seen 2026-10-18 · 89 functions in common (30% of this module's, 7% of that one's)
  • 9ec46827…692d8e1.4 MiB · first seen 2026-10-09 · 89 functions in common (30% of this module's, 7% of that one's)
  • a216278a…2939e41.4 MiB · first seen 2026-10-25 · 89 functions in common (30% of this module's, 7% of that one's)
  • f6ce19b6…9a52381.4 MiB · first seen 2026-10-23 · 89 functions in common (30% of this module's, 7% of that one's)
  • f4c76c59…9a2eda14.8 MiB · first seen 2026-10-06 · 80 functions in common (27% of this module's, under 1% of that one's)
  • f7f57ba1…0bdc1914.8 MiB · first seen 2026-10-27 · 80 functions in common (27% of this module's, under 1% of that one's)
  • 4a9296a1…a0984d17.0 MiB · first seen 2026-10-04 · 46 functions in common (16% of this module's, under 1% of that one's)
  • e89337bc…01aebd4.9 MiB · first seen 2026-10-23 · 56 functions in common (19% of this module's, under 1% of that one's)
  • 049b65b2…2857395.1 MiB · first seen 2026-10-03 · 53 functions in common (18% of this module's, under 1% of that one's)
  • 8db41a03…97cfd824.4 MiB · first seen 2026-10-05 · 30 functions in common (10% of this module's, under 1% of that one's)
  • 66b60122…61eeef2.7 MiB · first seen 2026-10-06 · 38 functions in common (13% of this module's, 2% of that one's)
  • a007d064…72bbc88.3 MiB · first seen 2026-10-27 · 37 functions in common (13% of this module's, under 1% of that one's)
  • 73ab13d9…002c67202.8 KiB · first seen 2026-10-28 · 34 functions in common (12% of this module's, 12% of that one's)
  • 9bd07bab…76d8659.6 MiB · first seen 2026-10-24 · 32 functions in common (11% of this module's, under 1% of that one's)

Seen on 2 public scans

PageTitleSeenHow it got there
web-i18n.tiktok.comLog in | TikTok2026-10-23Built by a script at run time
www.tiktok.comTikTok - Make Your Day2026-10-11Built by a script at run time