ScanMalware.com
WebAssembly module
API
This view is built from:
Module analysis/api/v1/wasm/d0b109db83c153b81ba0080fa2163664dff1e341b154edda6d40bc4b6fbc355eDecompiled code/api/v1/wasm/d0b109db83c153b81ba0080fa2163664dff1e341b154edda6d40bc4b6fbc355e/code

d0b109db83c153b81ba0080fa2163664dff1e341b154edda6d40bc4b6fbc355e

Dense data
Download .wasmSearch scans with this module

The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.

At a glance

What it is
Not identified. Its build does not name it and it matches no library we know.
How it was built
Not named in the module.
What it can do
None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
Where we saw it
On 1 public scan, 2026-10-24.
Findings
Dense data. Leads, not verdicts: legitimate modules show these too.
Size
217.8 KiB
First seen
2026-10-24
Last seen
2026-10-24
Public scans
1
Functions
115
Imports
4
Exports
11
Data segments
233

How it was built

The module names no language, compiler or build tool. Release builds often strip this information, and hand-written modules usually lack it.

Decompiled code

115 of 115 functions decompiled to C-like pseudocode; 4 more are imported from the page.

Beyond WebAssembly 1.0: Vector (SIMD) instructions (24 functions).

Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.

FunctionSizeBlocksComplexityNotes
No functions match.

File layout

WebAssembly binary format version 1, core module, 11 sections.

SectionOffsetSizeItems
type0x8235 bytes34
import0xf327 bytes4
function0x10e118 bytes115
table0x1847 bytes1
memory0x18b9 bytes1
global0x19410 bytes1
export0x19e47 bytes11
element0x1cd28 bytes1
datacount0x1e94 bytes
code0x1ed186.4 KiB115
data0x2ebb330.9 KiB233
Memory
259 pages (16.2 MiB), up to 32,768 pages (2.0 GiB)
Table
21 entries, up to 21 entries, funcref
Globals
1
Element segments
1
Declared data segments
233
Function names
none (names were stripped)

Data segments

Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 233 segments, 29.3 KiB in all. The chart shows 64: the first 64 and every encrypted or compressed one.

169 segments not drawn (19.6 KiB)02468Segment 0: 1,063 bytes, 4.96 bits per byteSegment 1: 1,120 bytes, 4.39 bits per byteSegment 2: 84 bytes, 5.86 bits per byteSegment 3: 84 bytes, 5.78 bits per byteSegment 4: 84 bytes, 5.9 bits per byteSegment 5: 84 bytes, 5.81 bits per byteSegment 6: 84 bytes, 5.68 bits per byteSegment 7: 84 bytes, 5.83 bits per byteSegment 8: 84 bytes, 5.85 bits per byteSegment 9: 84 bytes, 5.8 bits per byteSegment 10: 20 bytes, 3.15 bits per byteSegment 11: 20 bytes, 3.31 bits per byteSegment 12: 20 bytes, 3.31 bits per byteSegment 13: 20 bytes, 3.31 bits per byteSegment 14: 20 bytes, 3.31 bits per byteSegment 15: 20 bytes, 3.15 bits per byteSegment 16: 20 bytes, 3.31 bits per byteSegment 17: 20 bytes, 3.31 bits per byteSegment 18: 20 bytes, 3.41 bits per byteSegment 19: 214 bytes, 3.8 bits per byteSegment 20: 326 bytes, 3.57 bits per byteSegment 21: 376 bytes, 5.2 bits per byteSegment 22: 156 bytes, 6.25 bits per byteSegment 24: 9 bytes, 1.22 bits per byteSegment 25: 41 bytes, 3.15 bits per byteSegment 26: 41 bytes, 3.15 bits per byteSegment 27: 41 bytes, 3.15 bits per byteSegment 28: 41 bytes, 3.15 bits per byteSegment 29: 41 bytes, 3.1 bits per byteSegment 30: 41 bytes, 3.15 bits per byteSegment 31: 41 bytes, 3.05 bits per byteSegment 32: 41 bytes, 3.01 bits per byteSegment 33: 12 bytes, 2.75 bits per byteSegment 34: 18 bytes, 2.47 bits per byteSegment 35: 43 bytes, 3.16 bits per byteSegment 36: 234 bytes, 3.35 bits per byteSegment 37: 91 bytes, 2.69 bits per byteSegment 38: 724 bytes, 3.69 bits per byteSegment 39: 606 bytes, 3.68 bits per byteSegment 40: 54 bytes, 3.52 bits per byteSegment 41: 54 bytes, 2.94 bits per byteSegment 42: 254 bytes, 6.69 bits per byteSegment 43: 21 bytes, 1.15 bits per byteSegment 45: 180 bytes, 4.9 bits per byteSegment 46: 101 bytes, 1.45 bits per byteSegment 47: 5 bytes, 0.97 bits per byteSegment 48: 5 bytes, 1.37 bits per byteSegment 49: 137 bytes, 1.37 bits per byteSegment 50: 37 bytes, 1.27 bits per byteSegment 51: 141 bytes, 2.29 bits per byteSegment 52: 141 bytes, 2.29 bits per byteSegment 53: 141 bytes, 2.27 bits per byteSegment 54: 141 bytes, 2.18 bits per byteSegment 55: 141 bytes, 2.17 bits per byteSegment 56: 141 bytes, 2.24 bits per byteSegment 57: 141 bytes, 2.27 bits per byteSegment 58: 141 bytes, 2.27 bits per byteSegment 59: 141 bytes, 2.38 bits per byteSegment 60: 41 bytes, 2.96 bits per byteSegment 61: 229 bytes, 3.05 bits per byteSegment 62: 36 bytes, 2.87 bits per byteSegment 63: 69 bytes, 3 bits per byteSegment 23: 1,260 bytes, 7.5 bits per byte
data segment encrypted or compressed 169 segments not drawn 7.5 bits per byteHeight: bits per byte. Width: share of all the data.
  • Segment 23: 1,260 bytes at 7.5 bits per byte

Imports (4)

  • a.a
  • a.b
  • a.c
  • a.d

Exports (11)

Scripts that carry or load it

  • cdn.hailuoai.video carries it as text; the script is minified or bundled.

From public scans. A script loads a module when it fetches or compiles it.

In our sandbox

  • Produced 98 strings at run time, listed below.

Strings it produced at run time

Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host. Showing 80 of 98.

  1. 38CB!=C0
  2. nEqxoEW pE[
  3. $Fe7$Fhm$Fn
  4. -Fb4.F2k.F
  5. /FL"0FBY0F=
  6. 0FG51FSl1Fc
  7. 2FL%3F~\3F
  8. *;FXb;F)
  9. <F[!=FNY=FE
  10. >FD9>FLq>FW
  11. 2@FJj@F{
  12. GFp"HF/[HF
  13. IFS>IF&wIF
  14. KFN>KFEwKF@
  15. KFB"LFI[LFT
  16. $NF:]NFi
  17. 7VFxqVF4
  18. XFF'YF0aYF
  19. <]F;v]Fn
  20. hFO!iFC\iF:
  21. jFf4kF{okF
  22. 3|F+o|FN
  23. Gb" G[5 GUH GO[ GJn GE
  24. !G6,!G7?!G8R!G:e!G=x!G@
  25. "Go#"Gw6"G
  26. .#G&A#G7T#GHg#GZz#Gl
  27. &$G*9$GBL$GZ_$Gsr$G
  28. &GK*&Gr=&G
  29. \'G!p'GQ
  30. ))G0=)GmP)G
  31. *G-$*Gq7*G
  32. ;Go3;G*G;G
  33. \=Gcp=G-
  34. ">GZ6>G)J>G
  35. AGt(AGV<AG9PAG
  36. DGe1DG[EDGRYDGImDGA
  37. GGR)GG[=GGeQGGoeGGzyGG
  38. VHG$jHG5~HGG
  39. [IG-oIGE
  40. $JG28JGOLJGm`JG
  41. fKG=zKGb
  42. JMG<^MGmrMG
  43. NG;(NGp<NG
  44. =QG$RQGmfQG
  45. D`G~Y`G"n`G
  46. AcGyVcG/kcG
  47. fGm,fG4AfG
  48. :gGpOgG=dgG
  49. hGW4hG)IhG
  50. iGM.iG%CiG
  51. (jGd=jGBRjG gjG
  52. GlG}\lGfqlGQ
  53. 9oG|NoGvcoGqxoGl
  54. pGW pGV5pGUJpGU_pGUtpGV
  55. qGl1qGqFqGv[qG|pqG
  56. sG^*sGn?sG~TsG
  57. tG9'tGO<tGdQtGzftG
  58. uGV$uGq9uG
  59. avG8vvGZ
  60. .zG&DzG]YzG
  61. f!Hjm!H#t!H
  62. 85Xs76Fc7
  63. zcf8e9_9
  64. 9kZq7<$t
  65. ?96I(U9R
  66. 7]8sc49XD
  67. \A9>WR92
  68. `Q*gEQ?X-Q
  69. `N*gEN?X-N
  70. `K*gEK?X-K
  71. `H*gEH?X-H
  72. `E*gEE?X-E
  73. `B*gEB?X-B
  74. `?*gE??X-?
  75. `<*gE<?X-<
  76. ,i<"tG>'
  77. nR=pB:={
  78. h<PK`<r7X<
  79. f;~A_;b?X;2
  80. c8[7X8|FM8y

Checks we ran

  • Threat-feed matches: none
  • Names of mining software or pools: none
  • CryptoNight mining structure: not found
  • Hashing or cipher loops: none
  • Known hashing or cipher algorithms: none recognised
  • Encrypted or compressed data: 1 block, 1.2 KiB (4.2% of its data)
  • JavaScript stored inside: none
  • Other modules inside: none
  • Imports that read browser or page details: none
  • Function names: removed (usual in release builds)

Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.

Shares code with

Other modules that contain some of the same functions. They are ranked by functions few modules have, so a language's own runtime does not link every module built with it. Shared code often means a shared library or the same developer. It is a lead, not a verdict.

  • 7cc0a2cf…2e4ca916.3 MiB · first seen 2026-10-24 · 23 functions in common (25% of this module's, under 1% of that one's)
  • 4719e1d3…5e48d99.3 MiB · first seen 2026-10-23 · 18 functions in common (19% of this module's, under 1% of that one's)
  • 4a6b4153…24d50a9.3 MiB · first seen 2026-10-16 · 18 functions in common (19% of this module's, under 1% of that one's)
  • daa89379…23fb5f9.4 MiB · first seen 2026-10-28 · 18 functions in common (19% of this module's, under 1% of that one's)
  • a255a6ac…19c4ea2.7 MiB · first seen 2026-10-15 · 19 functions in common (20% of this module's, 2% of that one's)
  • f2a4eb82…b975f22.2 MiB · first seen 2026-10-20 · 20 functions in common (21% of this module's, 2% of that one's)
  • bf8f4571…838ef36.3 MiB · first seen 2026-10-14 · 16 functions in common (17% of this module's, under 1% of that one's)

Seen on 1 public scan

PageTitleSeenHow it got there
hailuoai.videoHailuo AI Video & Image Generator for Creators Online2026-10-24Base64 text in a script