ScanMalware.com
WebAssembly module
API
This view is built from:
Module analysis/api/v1/wasm/daa893790321df00ac9a447c72644199a8358337eae4f9794a63df94b723fb5fDecompiled code/api/v1/wasm/daa893790321df00ac9a447c72644199a8358337eae4f9794a63df94b723fb5f/code

daa893790321df00ac9a447c72644199a8358337eae4f9794a63df94b723fb5f

Known library: adobe-pdf-engineDense data
Download .wasmSearch scans with this module

The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.

At a glance

What it is
Known library: adobe-pdf-engine.
Names it came with
File name: text-zce (2 sites). Its build and the addresses it came from say so; whoever builds a module chooses these, so they are hints.
How it was built
Not named in the module.
What it can do
None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
Where we saw it
On 172 public scans, 2026-10-28 to 2026-10-29.
Findings
Dense data. Leads, not verdicts: legitimate modules show these too.
Size
9.4 MiB
First seen
2026-10-28
Last seen
2026-10-29
Public scans
172
Functions
18252
Imports
68
Exports
16
Data segments
3978

Analysis limits

Only its first 2,000 strings were read.

How it was built

The module names no language, compiler or build tool. Release builds often strip this information, and hand-written modules usually lack it.

Hashing and cipher code

Algorithms recognised from their published constants, tables and rotation amounts: SHA-1. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.

  • function 2028SHA-1 · its rotation amounts
  • function 3345SHA-1 · constants in its code
  • function 6065SHA-1 · constants in its code

Decompiled code

18,236 of 18,252 functions decompiled to C-like pseudocode; 67 more are imported from the page.

  • 16 of 18,252 functions could not be decompiled.

Beyond WebAssembly 1.0: Exception handling (6,632 functions).

Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.

FunctionSizeBlocksComplexityNotes
No functions match.

File layout

WebAssembly binary format version 1, core module, 13 sections (1 custom).

SectionOffsetSizeItems
type0x82.3 KiB236
import0x90f437 bytes68
function0xac417.9 KiB18,252
table0x527c11 bytes1
tag0x52877 bytes
global0x528e21 bytes3
export0x52a396 bytes16
start0x53034 bytes
element0x530734.6 KiB1
datacount0xdd5c4 bytes
code0xdd607.8 MiB18,252
data0x7d2b411.5 MiB3,978
custom: build_id0x95a56732 bytes
Memory
256 pages (16.0 MiB), up to 32,768 pages (2.0 GiB), imported from the page as a.a
Table
17,208 entries, up to 17,208 entries, funcref
Start function
function 11871, which runs as soon as the module is loaded
Globals
3
Element segments
1
Declared data segments
3,978
Exception tags
2
Function names
none (names were stripped)
Build ID
8a641b58f6d2ae6f40f6ec300a3c04d2c18e934f

Data segments

Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 3,978 segments, 1.5 MiB in all. The chart shows 72: the first 64 and every encrypted or compressed one.

3,906 segments not drawn (1.1 MiB)02468Segment 0: 116,659 bytes, 5.46 bits per byteSegment 1: 160 bytes, 4.2 bits per byteSegment 2: 99 bytes, 3.32 bits per byteSegment 3: 85 bytes, 3.08 bits per byteSegment 4: 39 bytes, 3.34 bits per byteSegment 5: 292 bytes, 4.81 bits per byteSegment 6: 231 bytes, 4.9 bits per byteSegment 7: 310 bytes, 5.05 bits per byteSegment 8: 66 bytes, 3 bits per byteSegment 9: 468 bytes, 5.04 bits per byteSegment 10: 132 bytes, 4.24 bits per byteSegment 11: 103 bytes, 4.56 bits per byteSegment 12: 21 bytes, 3.14 bits per byteSegment 13: 228 bytes, 4.42 bits per byteSegment 14: 21 bytes, 3.27 bits per byteSegment 15: 163 bytes, 4.72 bits per byteSegment 16: 176 bytes, 4.44 bits per byteSegment 17: 4,631 bytes, 4.61 bits per byteSegment 18: 4,295 bytes, 5.44 bits per byteSegment 19: 13,797 bytes, 5.18 bits per byteSegment 20: 1,413 bytes, 4.7 bits per byteSegment 21: 166 bytes, 1.72 bits per byteSegment 22: 5 bytes, 1.37 bits per byteSegment 23: 202 bytes, 2.59 bits per byteSegment 24: 313 bytes, 3.02 bits per byteSegment 25: 132 bytes, 1.93 bits per byteSegment 26: 61 bytes, 1.6 bits per byteSegment 27: 274 bytes, 1.86 bits per byteSegment 28: 112 bytes, 1.48 bits per byteSegment 29: 418 bytes, 1.84 bits per byteSegment 30: 8 bytes, 1.55 bits per byteSegment 31: 141 bytes, 1.48 bits per byteSegment 32: 37 bytes, 1.47 bits per byteSegment 33: 18 bytes, 1.12 bits per byteSegment 34: 4 bytes, 0.81 bits per byteSegment 35: 41 bytes, 1.55 bits per byteSegment 36: 16 bytes, 1.5 bits per byteSegment 37: 93 bytes, 1.56 bits per byteSegment 38: 34 bytes, 2.03 bits per byteSegment 39: 120 bytes, 1.71 bits per byteSegment 40: 45 bytes, 1.31 bits per byteSegment 41: 9 bytes, 1.45 bits per byteSegment 42: 17 bytes, 0.95 bits per byteSegment 43: 27 bytes, 1.19 bits per byteSegment 44: 54 bytes, 1.51 bits per byteSegment 45: 26 bytes, 1.55 bits per byteSegment 46: 7 bytes, 1.15 bits per byteSegment 47: 31 bytes, 1.38 bits per byteSegment 48: 66 bytes, 1.95 bits per byteSegment 49: 108 bytes, 1.34 bits per byteSegment 50: 281 bytes, 1.55 bits per byteSegment 51: 217 bytes, 1.74 bits per byteSegment 52: 62 bytes, 1.86 bits per byteSegment 53: 10,894 bytes, 6.05 bits per byteSegment 54: 196 bytes, 4.94 bits per byteSegment 55: 17 bytes, 0.95 bits per byteSegment 56: 52,663 bytes, 5.28 bits per byteSegment 60: 69 bytes, 0.56 bits per byteSegment 676: 121,743 bytes, 7.67 bits per byteSegment 2927: 51,862 bytes, 7.76 bits per byteSegment 2929: 9,129 bytes, 7.76 bits per byteSegment 2949: 5,930 bytes, 7.57 bits per byteSegment 2950: 6,780 bytes, 7.63 bits per byteSegment 2952: 11,437 bytes, 7.63 bits per byteSegment 2953: 15,821 bytes, 7.65 bits per byteSegment 2965: 24,771 bytes, 7.52 bits per byte
data segment encrypted or compressed 3,906 segments not drawn 7.5 bits per byteHeight: bits per byte. Width: share of all the data.
  • Segment 676: 121,743 bytes at 7.67 bits per byte
  • Segment 2927: 51,862 bytes at 7.76 bits per byte
  • Segment 2929: 9,129 bytes at 7.76 bits per byte
  • Segment 2949: 5,930 bytes at 7.57 bits per byte
  • Segment 2950: 6,780 bytes at 7.63 bits per byte
  • Segment 2952: 11,437 bytes at 7.63 bits per byte
  • Segment 2953: 15,821 bytes at 7.65 bits per byte
  • Segment 2965: 24,771 bytes at 7.52 bits per byte

Imports (68)

  • a.b
  • a.c
  • a.d
  • a.e
  • a.f
  • a.g
  • a.h
  • a.i
  • a.j
  • a.k
  • a.l
  • a.m
  • a.n
  • a.o
  • a.p
  • a.q
  • a.r
  • a.s
  • a.t
  • a.u
  • a.v
  • a.w
  • a.x
  • a.y
  • a.z
  • a.A
  • a.B
  • a.C
  • a.D
  • a.E
  • a.F
  • a.G
  • a.H
  • a.I
  • a.J
  • a.K
  • a.L
  • a.M
  • a.N
  • a.O
  • a.P
  • a.Q
  • a.R
  • a.S
  • a.T
  • a.U
  • a.V
  • a.W
  • a.X
  • a.Y

Exports (16)

Text it passes to the page

Fixed text the module hands to the page's JavaScript when it calls an import, read from the module file. Imports that reach the network, run code or change the page come first; web addresses are shown as their host.

ImportText
a.Dfloa
a.EATEK
a.EATEM
a.Flong lon
a.Funsigned
a.Rvoid
a.Sstd::string
a.Ubool
a.bvppi
a.bvppp
a.bctrlKey
a.bmetaKey
a.baltKey
a.bshiftKey
a.bisRepeat
a.brightClick
a.bclickCount
a.bvppd
a.bclientX
a.bclientY
a.bcanvasX
a.bcanvasY
a.bcmdKey
a.bactionKey
a.bisBarrelButtonPressed
a.babsoluteX
a.babsoluteY
a.bthickness
a.bstringIndex
a.bstringLength

Showing 30 of 398.

In our sandbox

  • Produced 27 strings at run time, listed below.

Strings it produced at run time

Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host. Showing 26 of 27.

  1. 22CTOutOfMemoryException
  2. g,10Type1Parse
  3. ]Z`c^_Ya[\b
  4. yPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyPyP
  5. N6icu_7717ResourceDataValueE
  6. N3SLO1…0EEE
  7. GHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefg
  8. `abcdefghijklmn
  9. 12WRThaiScript
  10. 15WRLaotianScript
  11. 16WRGurmukhiScript
  12. 16WRGujaratiScript
  13. 13WROriyaScript
  14. 14WRTeluguScript
  15. 15WRKannadaScript
  16. 13WRKhmerScript
  17. WRS_INFO IP ID:<AdobeIP#A0001584>
  18. Fasttext
  19. 9tBar_AE
  20. 2de_DE@2006
  21. s~ako_KR
  22. >/anl_NL
  23. 2=Xsat_IN
  24. -4F61-9;
  25. yJq3Gujr
  26. F61-99CD

Checks we ran

  • Threat-feed matches: none
  • Names of mining software or pools: none
  • CryptoNight mining structure: not found
  • Hashing or cipher loops: none
  • Known hashing or cipher algorithms: SHA-1
  • Encrypted or compressed data: 8 blocks, 241.7 KiB (15.7% of its data)
  • JavaScript stored inside: none
  • Other modules inside: none
  • Imports that read browser or page details: none
  • Function names: removed (usual in release builds)

Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.

Seen on 172 public scans

PageTitleSeenHow it got there
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAT&T Yahoo! Notifications2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file
new.express.adobe.comAdobe Express2026-10-29Downloaded as a file