f4cd84d5b95c255b99f9e46b0b6acba94c13e2e4870474ec5dc09bac8c28e039

How it was built

Uses WASI, the standard WebAssembly system interface.

System interface

WASIStandard calls for clocks, random numbers and files. In a browser the page's own JavaScript provides them.

Read from text inside the module (its build metadata and paths the compiler left) and from its import and export names. Whoever builds a module can change or remove these, so treat them as hints. They say how a module was made, not what it does.

Hashing and cipher code

Algorithms recognised from their published constants, tables and rotation amounts: Salsa20. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.

• function 21Salsa20 · its rotation amounts

Decompiled code

84 of 84 functions decompiled to C-like pseudocode; 5 more are imported from the page.

Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.

File layout

WebAssembly binary format version 1, core module, 10 sections.

Memory

256 pages (16.0 MiB), up to 256 pages (16.0 MiB)

Table

7 entries, up to 7 entries, funcref

Globals

1

Element segments

1

Function names

none (names were stripped)

Data segments

Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 20 segments, 33.0 KiB in all.

• Segment 0: 32,449 bytes at 7.99 bits per byte

Scripts that carry or load it

• qubictrade.com carries it as text and loads it; the script is minified or bundled.
• quhub.app carries it as text and loads it; the script is minified or bundled.

From public scans. A script loads a module when it fetches or compiles it.

In our sandbox

• Produced 3 strings at run time, listed below.
• Ran a long busy loop (often hashing).

Checks we ran

• Threat-feed matches: none
• Names of mining software or pools: none
• CryptoNight mining structure: not found
• Hashing or cipher loops: 5 functions (common in codecs and captchas)
• Known hashing or cipher algorithms: Salsa20
• Encrypted or compressed data: 1 block, 31.7 KiB (96.0% of its data)
• JavaScript stored inside: none
• Other modules inside: none
• Imports that read browser or page details: none
• Function names: removed (usual in release builds)

Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.

Shares code with

Other modules that contain some of the same functions. They are ranked by functions few modules have, so a language's own runtime does not link every module built with it. Shared code often means a shared library or the same developer. It is a lead, not a verdict.

• 73ab13d9…002c67202.8 KiB · first seen 2026-10-28 · 9 functions in common (13% of this module's, 3% of that one's)
• e070cd10…d2bb9924.4 KiB · first seen 2026-10-04 · 4 functions in common (6% of this module's, 22% of that one's)

Seen on 2 public scans