ScanMalware.com
WebAssembly module
API
This view is built from:
Module analysis/api/v1/wasm/7b785d70e8dde27a7f81842e3de0ba1a855857f059bb955a943e754aa956085cDecompiled code/api/v1/wasm/7b785d70e8dde27a7f81842e3de0ba1a855857f059bb955a943e754aa956085c/code

7b785d70e8dde27a7f81842e3de0ba1a855857f059bb955a943e754aa956085c

Dense dataHashing or cipher loops
Download .wasmSearch scans with this module

The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.

At a glance

What it is
Not identified. Its build does not name it and it matches no library we know.
How it was built
Not named in the module.
What it can do
None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
Where we saw it
On 1 public scan, 2026-10-11.
Findings
Dense data, Hashing or cipher loops. Leads, not verdicts: legitimate modules show these too.
Size
9.3 MiB
First seen
2026-10-11
Last seen
2026-10-11
Public scans
1
Functions
19330
Imports
154
Exports
33
Data segments
4354

Analysis limits

Only its first 2,000 strings were read.

Only the first 4,096 calls that pass fixed text to the page were read.

How it was built

The module names no language, compiler or build tool. Release builds often strip this information, and hand-written modules usually lack it.

Hashing and cipher code

Algorithms recognised from their published constants, tables and rotation amounts: AES, BLAKE2b, BLAKE2s or BLAKE3, Blowfish, CRC-32, ChaCha20, DES, SHA-1, SHA-1 or RIPEMD-160, SHA-256, SHA-512, SHA-512 or BLAKE2b, Salsa20, Salsa20 or ChaCha, Whirlpool. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.

  • function 912AES · a table it reads
  • function 984ChaCha20, Salsa20 or ChaCha · a table it reads, its rotation amounts
  • function 1031ChaCha20 · its rotation amounts
  • function 1244SHA-1 or RIPEMD-160 · constants in its code
  • function 1843Whirlpool · a table it reads
  • function 1851SHA-1 · constants in its code
  • function 2161SHA-512 · a table it reads, its rotation amounts
  • function 2514BLAKE2b · its rotation amounts
  • function 2548SHA-256 · its rotation amounts
  • function 2549SHA-1 · its rotation amounts
  • function 3128Salsa20, Salsa20 or ChaCha · constants in its code, its rotation amounts
  • function 3132SHA-256 · its rotation amounts
  • function 3176Salsa20 · its rotation amounts
  • function 4127BLAKE2b · its rotation amounts
  • function 4131BLAKE2b · constants in its code, its rotation amounts
  • function 4132Salsa20 · its rotation amounts
  • function 4263BLAKE2s or BLAKE3 · constants in its code, its rotation amounts
  • function 4266BLAKE2b · constants in its code, its rotation amounts
  • function 4360SHA-512 or BLAKE2b · constants in its code
  • function 4364SHA-512 or BLAKE2b · constants in its code

Showing 20 of 30 functions.

Decompiled code

19,329 of 19,330 functions decompiled to C-like pseudocode; 154 more are imported from the page.

  • 1 of 19,330 functions could not be decompiled.

Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.

FunctionSizeBlocksComplexityNotes
No functions match.

File layout

WebAssembly binary format version 1, core module, 11 sections.

SectionOffsetSizeItems
type0x81.4 KiB147
import0x58b1.0 KiB154
function0x99018.9 KiB19,330
table0x552c11 bytes1
memory0x55379 bytes1
global0x554016 bytes2
export0x5550201 bytes33
element0x561936.2 KiB1
datacount0xe7044 bytes
code0xe7086.4 MiB19,330
data0x6704122.9 MiB4,354
Memory
306 pages (19.1 MiB), up to 32,768 pages (2.0 GiB)
Table
17,004 entries, up to 17,004 entries, funcref
Globals
2
Element segments
1
Declared data segments
4,354
Function names
none (names were stripped)

Data segments

Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 4,354 segments, 2.9 MiB in all. The chart shows 73: the first 64 and every encrypted or compressed one.

4,281 segments not drawn (1.4 MiB)02468Segment 0: 388,273 bytes, 5.31 bits per byteSegment 1: 1,777 bytes, 4.94 bits per byteSegment 2: 3,973 bytes, 4.91 bits per byteSegment 3: 5,687 bytes, 5.04 bits per byteSegment 4: 2,007 bytes, 5.02 bits per byteSegment 5: 64 bytes, 4.28 bits per byteSegment 6: 449 bytes, 4.94 bits per byteSegment 7: 17 bytes, 1.26 bits per byteSegment 8: 9 bytes, 1.45 bits per byteSegment 9: 30,880 bytes, 5.11 bits per byteSegment 10: 236,210 bytes, 5.13 bits per byteSegment 11: 69 bytes, 3.72 bits per byteSegment 12: 1,162 bytes, 5.04 bits per byteSegment 13: 256 bytes, 1.05 bits per byteSegment 14: 1,856 bytes, 1.05 bits per byteSegment 15: 328 bytes, 2.99 bits per byteSegment 16: 4 bytes, 1.5 bits per byteSegment 17: 52,435 bytes, 7.23 bits per byteSegment 18: 183 bytes, 4.26 bits per byteSegment 19: 290 bytes, 7.63 bits per byteSegment 20: 96 bytes, 2.86 bits per byteSegment 22: 229 bytes, 2.19 bits per byteSegment 23: 666 bytes, 4.17 bits per byteSegment 24: 292 bytes, 5.05 bits per byteSegment 25: 147 bytes, 3.13 bits per byteSegment 26: 305 bytes, 3.47 bits per byteSegment 27: 58 bytes, 3.65 bits per byteSegment 28: 272 bytes, 5.34 bits per byteSegment 30: 132 bytes, 3 bits per byteSegment 31: 157 bytes, 3.72 bits per byteSegment 32: 10 bytes, 2.45 bits per byteSegment 33: 68 bytes, 4.58 bits per byteSegment 34: 276 bytes, 6.7 bits per byteSegment 35: 52 bytes, 2.62 bits per byteSegment 36: 38 bytes, 2.51 bits per byteSegment 37: 33 bytes, 3.74 bits per byteSegment 38: 299 bytes, 2.93 bits per byteSegment 39: 43 bytes, 0.99 bits per byteSegment 40: 81 bytes, 1 bits per byteSegment 41: 11,697 bytes, 5.73 bits per byteSegment 42: 818 bytes, 4.64 bits per byteSegment 43: 145 bytes, 4.34 bits per byteSegment 44: 97 bytes, 4.67 bits per byteSegment 45: 33 bytes, 3.68 bits per byteSegment 46: 20 bytes, 3.68 bits per byteSegment 47: 17 bytes, 2.02 bits per byteSegment 48: 35 bytes, 2.76 bits per byteSegment 49: 85 bytes, 3.08 bits per byteSegment 50: 980 bytes, 6.12 bits per byteSegment 51: 224 bytes, 0.1 bits per byteSegment 52: 5 bytes, 0.97 bits per byteSegment 54: 2 bytes, 1 bits per byteSegment 55: 6 bytes, 2.58 bits per byteSegment 56: 24 bytes, 4.22 bits per byteSegment 57: 87 bytes, 4.72 bits per byteSegment 58: 337,025 bytes, 7.42 bits per byteSegment 59: 32 bytes, 1.06 bits per byteSegment 61: 52 bytes, 1.08 bits per byteSegment 63: 30 bytes, 2.02 bits per byteSegment 138: 395,744 bytes, 7.87 bits per byteSegment 211: 13,377 bytes, 7.9 bits per byteSegment 271: 3,566 bytes, 7.68 bits per byteSegment 337: 21,631 bytes, 7.52 bits per byteSegment 347: 4,168 bytes, 7.95 bits per byteSegment 348: 16,464 bytes, 7.51 bits per byteSegment 367: 13,580 bytes, 7.94 bits per byteSegment 368: 8,155 bytes, 7.84 bits per byteSegment 383: 6,081 bytes, 7.79 bits per byte
data segment encrypted or compressed 4,281 segments not drawn 7.5 bits per byteHeight: bits per byte. Width: share of all the data.
  • Segment 138: 395,744 bytes at 7.87 bits per byte
  • Segment 211: 13,377 bytes at 7.9 bits per byte
  • Segment 271: 3,566 bytes at 7.68 bits per byte
  • Segment 337: 21,631 bytes at 7.52 bits per byte
  • Segment 347: 4,168 bytes at 7.95 bits per byte
  • Segment 348: 16,464 bytes at 7.51 bits per byte
  • Segment 367: 13,580 bytes at 7.94 bits per byte
  • Segment 368: 8,155 bytes at 7.84 bits per byte
  • Segment 383: 6,081 bytes at 7.79 bits per byte

Imports (154)

  • a.a
  • a.b
  • a.c
  • a.d
  • a.e
  • a.f
  • a.g
  • a.h
  • a.i
  • a.j
  • a.k
  • a.l
  • a.m
  • a.n
  • a.o
  • a.p
  • a.q
  • a.r
  • a.s
  • a.t
  • a.u
  • a.v
  • a.w
  • a.x
  • a.y
  • a.z
  • a.A
  • a.B
  • a.C
  • a.D
  • a.E
  • a.F
  • a.G
  • a.H
  • a.I
  • a.J
  • a.K
  • a.L
  • a.M
  • a.N
  • a.O
  • a.P
  • a.Q
  • a.R
  • a.S
  • a.T
  • a.U
  • a.V
  • a.W
  • a.X

Exports (33)

Scripts that carry or load it

  • my.aura.com loads it; the script is lightly obfuscated.

From public scans. A script loads a module when it fetches or compiles it.

Text it passes to the page

Fixed text the module hands to the page's JavaScript when it calls an import, read from the module file. Imports that reach the network, run code or change the page come first; web addresses are shown as their host.

ImportText
a.$fig_leaf
a.Memscripten::memory_view<char>
a.Memscripten::memory_view<signed char>
a.Memscripten::memory_view<unsigned char>
a.Memscripten::memory_view<short>
a.Memscripten::memory_view<unsigned short>
a.Memscripten::memory_view<int>
a.Memscripten::memory_view<unsigned int>
a.Memscripten::memory_view<long>
a.Memscripten::memory_view<unsigned long>
a.Memscripten::memory_view<int8_t>
a.Memscripten::memory_view<uint8_t>
a.Memscripten::memory_view<int16_t>
a.Memscripten::memory_view<uint16_t>
a.Memscripten::memory_view<int32_t>
a.Memscripten::memory_view<uint32_t>
a.Memscripten::memory_view<int64_t>
a.Memscripten::memory_view<uint64_t>
a.Memscripten::memory_view<float>
a.Memscripten::memory_view<double>
a.Runsigned char
a.Runsigned short
a.Runsi
a.Rlong
a.XKeyValue
a.XTelemetry
a.XValueServiceInterface
a.XVault
a.Xastd::string
a.bKey named '

Showing 30 of 478.

In our sandbox

  • Produced 14 strings at run time, listed below.
  • Ran a long busy loop (often hashing).

Strings it produced at run time

Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host.

  1. ABCDEF…ionE
  2. CONTENT_TYPE_JSONCONTENT_TYPE_PROTOBUFCONTENT_TYPE_UNKNOWN
  3. SQLite format 3
  4. naturaleftouterightfullinnercross
  5. 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
  6. 666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
  7. TLS 1.3, server CertificateVerify
  8. TLS 1.3, client CertificateVerify
  9. SigEd25519 no Ed25519 collisions
  10. ABCDEF…6789+/
  11. 0123456789.:abcdefABCDEF
  12. OpenSSL NIST SP 800-90A DRBG
  13. LC_CTYPE
  14. PKCS12 import pass phrase

Checks we ran

  • Threat-feed matches: none
  • Names of mining software or pools: none
  • CryptoNight mining structure: not found
  • Hashing or cipher loops: 23 functions (common in codecs and captchas)
  • Known hashing or cipher algorithms: AES, BLAKE2b, BLAKE2s or BLAKE3, Blowfish, CRC-32, ChaCha20, DES, SHA-1, SHA-1 or RIPEMD-160, SHA-256, SHA-512, SHA-512 or BLAKE2b, Salsa20, Salsa20 or ChaCha, Whirlpool
  • Encrypted or compressed data: 9 blocks, 471.5 KiB (16.0% of its data)
  • JavaScript stored inside: none
  • Other modules inside: none
  • Imports that read browser or page details: none
  • Function names: removed (usual in release builds)

Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.

Shares code with

Other modules that contain some of the same functions. They are ranked by functions few modules have, so a language's own runtime does not link every module built with it. Shared code often means a shared library or the same developer. It is a lead, not a verdict.

  • 0734155c…f62d73644.3 KiB · first seen 2026-10-22 · 145 functions in common (2% of this module's, 13% of that one's)
  • 38c14f6e…96670a643.0 KiB · first seen 2026-10-17 · 127 functions in common (2% of this module's, 12% of that one's)

Seen on 1 public scan

PageTitleSeenHow it got there
my.aura.comAura • Sign in2026-10-11Built by a script at run time