6e45ba2cfef34302f85bff6628f0c984bc991284ffd59faaa20ec244bfcd5f78
The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.
At a glance
- What it is
- Not identified. Its build does not name it and it matches no library we know.
- Names it came with
- File name: crypto-signer. Its build and the addresses it came from say so; whoever builds a module chooses these, so they are hints.
- How it was built
- Written in Rust. wasm-bindgen connects it to the page's JavaScript.
- What it can do
- Its imports reach: cryptography. Judged from the names of its imports.
- Where we saw it
- On 1 public scan, 2026-10-16.
- Findings
- Nothing flagged by the checks below.
- Size
- 44.9 KiB
- First seen
- 2026-10-16
- Last seen
- 2026-10-16
- Public scans
- 1
- Functions
- 103
- Imports
- 29
- Exports
- 12
- Data segments
- 7
How it was built
Written in Rust. wasm-bindgen connects it to the page's JavaScript.
- Language
- RustImplied: wasm-bindgen is only used with Rust.
- Connects to JavaScript
- wasm-bindgenRust's bridge to JavaScript. It writes glue code on both sides, so the module can call page functions such as fetch or the DOM, and the page can call the module.
- Rewritten after compiling
- walrusA library for rewriting compiled modules. wasm-bindgen runs it on every build, so it comes with wasm-bindgen and says nothing more about the module.
Read from text inside the module (its build metadata and paths the compiler left) and from its import and export names. Whoever builds a module can change or remove these, so treat them as hints. They say how a module was made, not what it does.
What it is made of
3 Rust crates from crates.io, with the versions it was built with:
Build tools and versions it names:
- Rust
- rustc 1.85.1 (4eb161250 2025-03-15)
- walrus 0.23.3
- wasm-bindgen 0.2.100 (2405ec2b4)
Read from text the build left in the module: source paths, build metadata and .NET metadata. Whoever builds a module can change or remove it, so treat it as a hint.
Hashing and cipher code
Algorithms recognised from their published constants, tables and rotation amounts: SHA-256. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.
- cryptosigner_generateSignatureSHA-256 · a table it reads
Decompiled code
103 of 103 functions decompiled to C-like pseudocode; 29 more are imported from the page.
Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.
| Function | Size | Blocks | Complexity | Notes |
|---|---|---|---|---|
| No functions match. | ||||
File layout
WebAssembly binary format version 1, core module, 12 sections (2 custom).
| Section | Offset | Size | Items |
|---|---|---|---|
| type | 0x8 | 247 bytes | 35 |
| import | 0xff | 1.1 KiB | 29 |
| function | 0x547 | 106 bytes | 103 |
| table | 0x5b1 | 11 bytes | 2 |
| memory | 0x5bc | 5 bytes | 1 |
| global | 0x5c1 | 11 bytes | 1 |
| export | 0x5cc | 269 bytes | 12 |
| element | 0x6d9 | 55 bytes | 1 |
| code | 0x710 | 36.7 KiB | 103 |
| data | 0x99d3 | 6.3 KiB | 7 |
| custom: producers | 0xb2f4 | 126 bytes | |
| custom: target_features | 0xb372 | 75 bytes |
- Memory
- 17 pages (1.1 MiB), no upper limit
- Table 0
- 46 entries, up to 46 entries, funcref
- Table 1
- 128 entries, no upper limit, externref
- Globals
- 1
- Element segments
- 1
- Function names
- none (names were stripped)
- Target features
- +mutable-globals +sign-ext +reference-types +multivalue
Data segments
Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 7 segments, 6.2 KiB in all.
Imports (29)
Can reach: crypto.
Imports from wbg are wasm-bindgen glue. Each __wbg_… import calls one JavaScript function in the page, and its name says which (__wbg_fetch_… calls fetch). The __wbindgen_… imports are wasm-bindgen's own helpers for strings, errors and memory.
- wbg.__wbindgen_memory
- wbg.__wbg_buffer_609cc3eee51ed158
- wbg.__wbg_newwithbyteoffsetandlength_d97e637ebe145a9a
- wbg.__wbg_randomFillSync_ac0988aba3254290
- wbg.__wbg_subarray_aa9065fa9dc5df96
- wbg.__wbg_getRandomValues_b8f5dbd5f3995a9e
- wbg.__wbg_new_a12002a7f91c75be
- wbg.__wbg_set_65595bdd868b3009
- wbg.__wbg_crypto_574e78ad8b13b65f
- wbg.__wbindgen_is_object
- wbg.__wbg_process_dc0fbacc7c1c06f7
- wbg.__wbg_versions_c01dfd4722a88165
- wbg.__wbg_node_905d3e251edff8a2
- wbg.__wbindgen_is_string
- wbg.__wbg_require_60cc747a6bc5215a
- wbg.__wbindgen_is_function
- wbg.__wbindgen_string_new
- wbg.__wbg_msCrypto_a61aeb35a24c1329
- wbg.__wbg_newwithlength_a381634e90c276d4
- wbg.__wbindgen_is_undefined
- wbg.__wbg_newnoargs_105ed471475aaf50
- wbg.__wbg_call_672a4d21634d4a24
- wbg.__wbg_static_accessor_GLOBAL_88a902d13a557d07
- wbg.__wbg_static_accessor_GLOBAL_THIS_56578be7e9f832b0
- wbg.__wbg_static_accessor_WINDOW_5de37043a91a9c40
- wbg.__wbg_static_accessor_SELF_37c5d418e4bf5819
- wbg.__wbg_call_7cccdd69e0791ae2
- wbg.__wbindgen_throw
- wbg.__wbindgen_init_externref_table
Exports (12)
Scripts that carry or load it
- handbook.fca.org.uk loads it; the script is minified or bundled.
From public scans. A script loads a module when it fetches or compiles it.
Text it passes to the page
Fixed text the module hands to the page's JavaScript when it calls an import, read from the module file. Imports that reach the network, run code or change the page come first; web addresses are shown as their host.
| Import | Text |
|---|---|
| wbg.__wbg_newnoargs_105ed471475aaf50 | return this |
| wbg.__wbindgen_string_new | crypto |
In our sandbox
- Produced 2 strings at run time, listed below.
Strings it produced at run time
Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host.
- [...]begin <= end ( <= ) when slicing ``
- dh&6%n@)M
Checks we ran
- Threat-feed matches: none
- Names of mining software or pools: none
- CryptoNight mining structure: not found
- Hashing or cipher loops: none
- Known hashing or cipher algorithms: SHA-256
- Encrypted or compressed data: none
- JavaScript stored inside: none
- Other modules inside: none
- Imports that read browser or page details: 1
- Function names: removed (usual in release builds)
Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.
Seen on 1 public scan
| Page | Title | Seen | How it got there |
|---|---|---|---|
| handbook.fca.org.uk | FCA Handbook | 2026-10-16 | Downloaded as a file |