ScanMalware.com
WebAssembly module
API
This view is built from:
Module analysis/api/v1/wasm/f4c76c59284974391dbdccc8c292b2ba5f96fc4b98043f54cb8c46824c9a2edaDecompiled code/api/v1/wasm/f4c76c59284974391dbdccc8c292b2ba5f96fc4b98043f54cb8c46824c9a2eda/code

f4c76c59284974391dbdccc8c292b2ba5f96fc4b98043f54cb8c46824c9a2eda

Known library: adobe-pdf-engineDense dataHashing or cipher loops
Download .wasmSearch scans with this module

The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.

At a glance

What it is
Known library: adobe-pdf-engine.
How it was built
Not named in the module.
What it can do
None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
Where we saw it
On 3 public scans, 2026-10-06 to 2026-10-20.
Findings
Dense data, Hashing or cipher loops. Leads, not verdicts: legitimate modules show these too.
Size
14.8 MiB
First seen
2026-10-06
Last seen
2026-10-20
Public scans
3
Functions
45183
Imports
231
Exports
16
Data segments
5000

Analysis limits

Only its first 2,000 strings were read.

How it was built

The module names no language, compiler or build tool. Release builds often strip this information, and hand-written modules usually lack it.

Hashing and cipher code

Algorithms recognised from their published constants, tables and rotation amounts: AES, BLAKE2b, BLAKE2s or BLAKE3, Blowfish, CRC-32, ChaCha20, DES, MD5, MD5, SHA-1 or RIPEMD-160, SHA-1, SHA-1 or RIPEMD-160, SHA-256, SHA-512, SHA-512 or BLAKE2b, Salsa20 or ChaCha, Whirlpool. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.

  • function 2499MD5, SHA-1 or RIPEMD-160 · constants in its code
  • function 3130DES · a table it reads
  • function 6257AES · a table it reads
  • function 6266Whirlpool · a table it reads
  • function 8013MD5, SHA-1 or RIPEMD-160 · constants in its code
  • function 8175DES · a table it reads
  • function 8458CRC-32 · constants in its code
  • function 8694SHA-512 · a table it reads, its rotation amounts
  • function 10673SHA-256, SHA-512 · a table it reads, its rotation amounts
  • function 10674SHA-1 · its rotation amounts
  • function 10764MD5 · its rotation amounts
  • function 11837SHA-1 or RIPEMD-160 · constants in its code
  • function 12247MD5 · its rotation amounts
  • function 12749ChaCha20, Salsa20 or ChaCha · constants in its code, its rotation amounts
  • function 15057SHA-1 · its rotation amounts
  • function 15274BLAKE2s or BLAKE3 · constants in its code, its rotation amounts
  • function 15275BLAKE2b · constants in its code, its rotation amounts
  • function 24101SHA-512 or BLAKE2b · constants in its code
  • function 24103SHA-512 or BLAKE2b · constants in its code
  • function 29510MD5 · constants in its code

Showing 20 of 26 functions.

Decompiled code

45,175 of 45,183 functions decompiled to C-like pseudocode; 231 more are imported from the page.

  • 8 of 45,183 functions could not be decompiled.

Beyond WebAssembly 1.0: Exception handling (11,295 functions).

Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.

FunctionSizeBlocksComplexityNotes
No functions match.

File layout

WebAssembly binary format version 1, core module, 11 sections.

SectionOffsetSizeItems
type0x83.8 KiB395
import0xf651.5 KiB231
function0x158644.5 KiB45,183
table0xc77911 bytes1
memory0xc7849 bytes1
tag0xc78d5 bytes
global0xc79211 bytes1
export0xc79d110 bytes16
element0xc80b61.4 KiB1
code0x1bdb510.9 MiB45,183
data0xb0364e3.7 MiB5,000
Memory
256 pages (16.0 MiB), up to 32,768 pages (2.0 GiB)
Table
23,411 entries, up to 23,411 entries, funcref
Globals
1
Element segments
1
Exception tags
1
Function names
none (names were stripped)

Data segments

Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 5,000 segments, 3.7 MiB in all. The chart shows 79: the first 64 and every encrypted or compressed one.

4,921 segments not drawn (3.3 MiB)02468Segment 0: 311,865 bytes, 5.82 bits per byteSegment 3: 25 bytes, 1.42 bits per byteSegment 6: 1,493 bytes, 7.05 bits per byteSegment 7: 399 bytes, 5.28 bits per byteSegment 9: 53 bytes, 1.24 bits per byteSegment 10: 13 bytes, 1.51 bits per byteSegment 11: 16,513 bytes, 5.42 bits per byteSegment 12: 389 bytes, 3.12 bits per byteSegment 13: 6,715 bytes, 5.36 bits per byteSegment 14: 873 bytes, 5.17 bits per byteSegment 15: 347 bytes, 4.43 bits per byteSegment 16: 43 bytes, 2.79 bits per byteSegment 17: 679 bytes, 3.76 bits per byteSegment 18: 651 bytes, 3.63 bits per byteSegment 19: 639 bytes, 3.72 bits per byteSegment 20: 663 bytes, 3.77 bits per byteSegment 21: 663 bytes, 3.72 bits per byteSegment 22: 982 bytes, 4.5 bits per byteSegment 23: 635 bytes, 3.67 bits per byteSegment 24: 635 bytes, 3.68 bits per byteSegment 25: 663 bytes, 3.77 bits per byteSegment 26: 631 bytes, 3.89 bits per byteSegment 27: 570 bytes, 3.56 bits per byteSegment 28: 639 bytes, 3.72 bits per byteSegment 29: 647 bytes, 3.75 bits per byteSegment 30: 570 bytes, 3.56 bits per byteSegment 31: 631 bytes, 3.68 bits per byteSegment 32: 635 bytes, 3.66 bits per byteSegment 33: 1,367 bytes, 3.87 bits per byteSegment 34: 631 bytes, 3.66 bits per byteSegment 35: 602 bytes, 3.5 bits per byteSegment 36: 611 bytes, 3.78 bits per byteSegment 37: 570 bytes, 3.56 bits per byteSegment 38: 635 bytes, 3.69 bits per byteSegment 39: 570 bytes, 3.53 bits per byteSegment 40: 570 bytes, 3.56 bits per byteSegment 41: 631 bytes, 3.66 bits per byteSegment 42: 655 bytes, 3.73 bits per byteSegment 43: 570 bytes, 3.53 bits per byteSegment 44: 570 bytes, 3.56 bits per byteSegment 45: 631 bytes, 3.68 bits per byteSegment 46: 647 bytes, 3.74 bits per byteSegment 47: 570 bytes, 3.56 bits per byteSegment 48: 631 bytes, 3.66 bits per byteSegment 49: 647 bytes, 3.76 bits per byteSegment 50: 570 bytes, 3.56 bits per byteSegment 51: 631 bytes, 3.65 bits per byteSegment 52: 647 bytes, 3.75 bits per byteSegment 53: 570 bytes, 3.56 bits per byteSegment 54: 635 bytes, 3.69 bits per byteSegment 55: 659 bytes, 3.77 bits per byteSegment 56: 570 bytes, 3.53 bits per byteSegment 57: 570 bytes, 3.56 bits per byteSegment 58: 631 bytes, 3.68 bits per byteSegment 59: 647 bytes, 3.73 bits per byteSegment 60: 570 bytes, 3.56 bits per byteSegment 61: 722 bytes, 3.61 bits per byteSegment 62: 647 bytes, 3.66 bits per byteSegment 63: 786 bytes, 4.1 bits per byteSegment 4: 2,543 bytes, 7.81 bits per byteSegment 534: 2,169 bytes, 7.74 bits per byteSegment 1040: 5,234 bytes, 7.94 bits per byteSegment 1081: 2,078 bytes, 7.78 bits per byteSegment 1103: 1,563 bytes, 7.98 bits per byteSegment 1213: 1,622 bytes, 7.52 bits per byteSegment 1215: 1,622 bytes, 7.52 bits per byteSegment 1227: 2,164 bytes, 7.74 bits per byteSegment 1253: 4,096 bytes, 7.74 bits per byteSegment 3178: 4,551 bytes, 7.93 bits per byteSegment 3179: 1,185 bytes, 7.6 bits per byteSegment 3195: 12,287 bytes, 7.71 bits per byteSegment 3296: 3,321 bytes, 7.75 bits per byteSegment 3301: 13,248 bytes, 7.89 bits per byteSegment 3302: 8,144 bytes, 7.84 bits per byteSegment 3970: 19,054 bytes, 7.72 bits per byte
data segment encrypted or compressed 4,921 segments not drawn 7.5 bits per byteHeight: bits per byte. Width: share of all the data.
  • Segment 4: 2,543 bytes at 7.81 bits per byte
  • Segment 534: 2,169 bytes at 7.74 bits per byte
  • Segment 1040: 5,234 bytes at 7.94 bits per byte
  • Segment 1081: 2,078 bytes at 7.78 bits per byte
  • Segment 1103: 1,563 bytes at 7.98 bits per byte
  • Segment 1213: 1,622 bytes at 7.52 bits per byte
  • Segment 1215: 1,622 bytes at 7.52 bits per byte
  • Segment 1227: 2,164 bytes at 7.74 bits per byte
  • Segment 1253: 4,096 bytes at 7.74 bits per byte
  • Segment 3178: 4,551 bytes at 7.93 bits per byte
  • Segment 3179: 1,185 bytes at 7.6 bits per byte
  • Segment 3195: 12,287 bytes at 7.71 bits per byte
  • Segment 3296: 3,321 bytes at 7.75 bits per byte
  • Segment 3301: 13,248 bytes at 7.89 bits per byte
  • Segment 3302: 8,144 bytes at 7.84 bits per byte
  • Segment 3970: 19,054 bytes at 7.72 bits per byte

Imports (231)

  • a.a
  • a.b
  • a.c
  • a.d
  • a.e
  • a.f
  • a.g
  • a.h
  • a.i
  • a.j
  • a.k
  • a.l
  • a.m
  • a.n
  • a.o
  • a.p
  • a.q
  • a.r
  • a.s
  • a.t
  • a.u
  • a.v
  • a.w
  • a.x
  • a.y
  • a.z
  • a.A
  • a.B
  • a.C
  • a.D
  • a.E
  • a.F
  • a.G
  • a.H
  • a.I
  • a.J
  • a.K
  • a.L
  • a.M
  • a.N
  • a.O
  • a.P
  • a.Q
  • a.R
  • a.S
  • a.T
  • a.U
  • a.V
  • a.W
  • a.X

Exports (16)

Text it passes to the page

Fixed text the module hands to the page's JavaScript when it calls an import, read from the module file. Imports that reach the network, run code or change the page come first; web addresses are shown as their host.

ImportText
a.Jans.adobe.com
a.JaKeywords
a.P{/x -1000 def 500 120 translate}
a.c{/dY exdef}
a.c{SansSerif}
a.c{/dX exdef}
a.cound
a.d{pop dY 0 lt{-1}{1}ifelse/dY exdef}
a.g{pop systemdict/languagelevel get 2 ge}
a.jiiii
a.jcns.adobe.com
a.jcKeywords
a.k/BlueValues missing: FD[%ld]
a.kcns.adobe.com
a.kcKeywords
a.rruntime.defaultCameraChange = true
a.v(sfr) can't init lib

Hosts and scripts inside

www.adobe.com

In our sandbox

  • Produced 82 strings at run time, listed below.

Strings it produced at run time

Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host. Showing 80 of 82.

  1. central_parallel
  2. longitude_of_origin
  3. standard_parallel_2
  4. x_axis_rotation
  5. s_coordinate_of_rotation_origin
  6. y_axis_rotation
  7. y_coordinate_of_rotation_origin
  8. z_axis_rotation
  9. z_coordinate_of_rotation_origin
  10. CentralMeridian
  11. Central_Parallel
  12. Longitude_Of_Origin
  13. Standard_Parallel_2
  14. Equidistant_Cylindrical
  15. Hotine_Oblique_Mercator_Azimuth_Center
  16. Hotine_Oblique_Mercator_Azimuth_Natural_Origin
  17. Van_der_Grinten_I
  18. tvcmgpfdaehaehhxtmhpxamperp
  19. 20TTNameRecordsAndData
  20. CDATA[version
  21. $$$SUBSTITUTEBASE findfont dup maxlength 19 add dict begin/SubstMaster exch
  22. T)U)V)W)X)Y)Z)[)\)])^)_)`)a)b)c)d)e)f)g)h)i)j)k)l)m)n)o)p)q)r)s)t)u)v)w)x)y)z){)|)})~)
  23. RESETEUEVEWEXEYEZE[E\E]E^E_E`EaEbEcEdEeEfEgEhEiEjEkElEmEnEoEpEqErEsEtEuEvEwExEyEzE{E|E}E~E
  24. gJhJiJjJkJlJmJnJoJpJqJrJsJtJuJvJwJxJyJ
  25. KPLPMPNPOPPPQP
  26. qPrPsPtPuPvPwPxPyPzP{P|P}P~P
  27. (V)V*V+V,V-V.V/V0V1V2V3V4V5V6V7V8V9V:V;V<V=V>V?V@V
  28. BVCVDVEVFVGVHVIVJVKVLVMVNVOVPVQVRVSVTVUVVVWVXVYVZV[V\V]V^V_V`VaVbVcVdVeVfVgVhViVjVkVlVmVnVoVpVqVrVsV
  29. =y>y?y@yAyByCyDyEyFyGyHyIyJyKyLyMyNyOyPyQyRySyTyUyVyWyXyYyZy[y\y]y^y_y`yaybycydyeyfygyhyiyjykylymynyoypyqyrysytyuyvy
  30. E:F:G:H:I:J:K:L:M:N:O:P:Q:R:S:T:U:V:W:X:Y:Z:[:\:]:^:_:`:
  31. J=K=L=M=N=O=P=Q=R=S=
  32. [=\=]=^=_=
  33. ,F-F.F/F0F1F2F3F4F5F6F7F8F9F:F;F<F=F>F?F@FAFBFCFDFEFFFGFHFIFJFKFLFMFNFOFPFQFRFSFTFUFVF
  34. ;I<I=I>I?I@IAIBICIDIEIFIGIHIIIJIKILIMINIOIPIQIRISITIUIVIWIXIYIZI[I\I]I^I_I`IaIbIcIdIeIfIgIhIiIjIkIlImInIoIpIqI
  35. rIsItIuIvIwIxIyIzI{I|I}I~I
  36. 9K:K;K<K=K>K?K@K
  37. XLYLZL[L\L]L^L_L`LaLbLcLdLeLfLgLhLiLjLkLlLmLnLoLpLqL
  38. 2M3M4M5M6M7M8M9M:M;M<M=M>M?M@MAMBMCMDMEMFMGMHMIMJMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYM
  39. :N;N<N=N>N?N@NANBNCNDNENFNGNHNINJNKNLNMNNNONPN
  40. rOsOtOuOvOwOxOyOzO{O|O}O~O
  41. wRxRyRzR{R|R}R~R
  42. )d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dad
  43. PeQeReSeTeUeVeWeXeYe
  44. vewexeyeze{e|e}e~e
  45. hfifjfkflfmfnfofpfqfrfsftfufvfwfxf
  46. B{C{D{E{
  47. N3arf12GlyphMatcherE
  48. LC_CTYPE
  49. D_gsat_Greenwich
  50. WRS_INFO IP ID:<AdobeIP#A0001584>
  51. acegmnopqrsuvwxyz
  52. UUUUUUe@
  53. """3"D"U"f"w"
  54. 3"333D3U3f3w3
  55. D"D3DDDUDfDwD
  56. U"U3UDUUUfUwU
  57. f"f3fDfUfffwf
  58. w"w3wDwUwfwww
  59. !)1:BJRZcks{
  60. $(-159=AEIMQUY]aeimquy}
  61. ort/cmaps/
  62. ort/unicode/
  63. ort/FntNames.db
  64. Out of Memory
  65. 0x003ea5fc
  66. 0x003ea5f4
  67. 0x003f54ac
  68. EndGroup
  69. GetPortColorSpace
  70. GetBuffer
  71. GetBounds
  72. GetByteWidth
  73. GetTileImage
  74. GetInjectionType
  75. GetEPSResourceServer
  76. GetFontPSStream
  77. InjectEPSContent
  78. $$$$$$$$$$$$$$$$$$$$$$$$$$HHHHHHHHHHHHHHHHHHHHHHHHHllllllllllllllllllllllllll
  79. 00030<0?0
  80. 30333<3?3

Checks we ran

  • Threat-feed matches: none
  • Names of mining software or pools: none
  • CryptoNight mining structure: not found
  • Hashing or cipher loops: 15 functions (common in codecs and captchas)
  • Known hashing or cipher algorithms: AES, BLAKE2b, BLAKE2s or BLAKE3, Blowfish, CRC-32, ChaCha20, DES, MD5, MD5, SHA-1 or RIPEMD-160, SHA-1, SHA-1 or RIPEMD-160, SHA-256, SHA-512, SHA-512 or BLAKE2b, Salsa20 or ChaCha, Whirlpool
  • Encrypted or compressed data: 16 blocks, 82.9 KiB (2.2% of its data)
  • JavaScript stored inside: none
  • Other modules inside: none
  • Imports that read browser or page details: none
  • Function names: removed (usual in release builds)

Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.

Shares code with

Other modules that contain some of the same functions. They are ranked by functions few modules have, so a language's own runtime does not link every module built with it. Shared code often means a shared library or the same developer. It is a lead, not a verdict.

  • 655cc4de…12c76c277.4 KiB · first seen 2026-10-11 · 80 functions in common (under 1% of this module's, 27% of that one's)

Seen on 3 public scans

PageTitleSeenHow it got there
acrobat.adobe.com90511890988 - Adobe cloud storage2026-10-20Built by a script at run time
acrobat.adobe.com90511890988 - Adobe cloud storage2026-10-13Built by a script at run time
acrobat.adobe.com90511890988 - Adobe cloud storage2026-10-06Built by a script at run time