ScanMalware.com
WebAssembly module
API
This view is built from:
Module analysis/api/v1/wasm/f7f57ba1f1c451eaa9f4c75d7bf9912751206ad3a9d87d30d514b50b570bdc19Decompiled code/api/v1/wasm/f7f57ba1f1c451eaa9f4c75d7bf9912751206ad3a9d87d30d514b50b570bdc19/code

f7f57ba1f1c451eaa9f4c75d7bf9912751206ad3a9d87d30d514b50b570bdc19

Known library: adobe-pdf-engineDense dataHashing or cipher loops
Download .wasmSearch scans with this module

The file is the module exactly as the page had it. WebAssembly does nothing on its own: it runs only when a script instantiates it. Labels describe what the module contains and are leads, not verdicts.

At a glance

What it is
Known library: adobe-pdf-engine.
Names it came with
File name: adccomponents-we. Its build and the addresses it came from say so; whoever builds a module chooses these, so they are hints.
How it was built
Not named in the module.
What it can do
None of its imports reaches the network, runs code or changes the page. Judged from the names of its imports.
Where we saw it
On 1 public scan, 2026-10-27.
Findings
Dense data, Hashing or cipher loops. Leads, not verdicts: legitimate modules show these too.
Size
14.8 MiB
First seen
2026-10-27
Last seen
2026-10-27
Public scans
1
Functions
45193
Imports
231
Exports
16
Data segments
4999

Analysis limits

Only its first 2,000 strings were read.

How it was built

The module names no language, compiler or build tool. Release builds often strip this information, and hand-written modules usually lack it.

Hashing and cipher code

Algorithms recognised from their published constants, tables and rotation amounts: AES, BLAKE2b, BLAKE2s or BLAKE3, Blowfish, CRC-32, ChaCha20, DES, MD5, MD5, SHA-1 or RIPEMD-160, SHA-1, SHA-1 or RIPEMD-160, SHA-256, SHA-512, SHA-512 or BLAKE2b, Salsa20 or ChaCha, Whirlpool. Legitimate modules use them all the time, for hashing, captchas and encryption, so this is a lead, not a verdict.

  • function 2499MD5, SHA-1 or RIPEMD-160 · constants in its code
  • function 3130DES · a table it reads
  • function 6261AES · a table it reads
  • function 6270Whirlpool · a table it reads
  • function 8018MD5, SHA-1 or RIPEMD-160 · constants in its code
  • function 8179DES · a table it reads
  • function 8462CRC-32 · constants in its code
  • function 8698SHA-512 · a table it reads, its rotation amounts
  • function 10678SHA-256, SHA-512 · a table it reads, its rotation amounts
  • function 10679SHA-1 · its rotation amounts
  • function 10769MD5 · its rotation amounts
  • function 11841SHA-1 or RIPEMD-160 · constants in its code
  • function 12251MD5 · its rotation amounts
  • function 12753ChaCha20, Salsa20 or ChaCha · constants in its code, its rotation amounts
  • function 15061SHA-1 · its rotation amounts
  • function 15278BLAKE2s or BLAKE3 · constants in its code, its rotation amounts
  • function 15279BLAKE2b · constants in its code, its rotation amounts
  • function 24103SHA-512 or BLAKE2b · constants in its code
  • function 24105SHA-512 or BLAKE2b · constants in its code
  • function 29514MD5 · constants in its code

Showing 20 of 26 functions.

Decompiled code

45,183 of 45,193 functions decompiled to C-like pseudocode; 231 more are imported from the page.

  • 10 of 45,193 functions could not be decompiled.

Beyond WebAssembly 1.0: Exception handling (11,300 functions).

Decompiled code is a reconstruction from the file, so names and types are often guesses. Query values in URLs are masked here; the downloaded file is unchanged.

FunctionSizeBlocksComplexityNotes
No functions match.

File layout

WebAssembly binary format version 1, core module, 11 sections.

SectionOffsetSizeItems
type0x83.8 KiB395
import0xf651.5 KiB231
function0x158644.5 KiB45,193
table0xc78311 bytes1
memory0xc78e9 bytes1
tag0xc7975 bytes
global0xc79c11 bytes1
export0xc7a7110 bytes16
element0xc81561.4 KiB1
code0x1bdda10.9 MiB45,193
data0xb044713.7 MiB4,999
Memory
256 pages (16.0 MiB), up to 32,768 pages (2.0 GiB)
Table
23,421 entries, up to 23,421 entries, funcref
Globals
1
Element segments
1
Exception tags
1
Function names
none (names were stripped)

Data segments

Each bar is one segment of the module's data: as wide as its size, as tall as its entropy. Bars above the dashed line are encrypted or compressed. 4,999 segments, 3.7 MiB in all. The chart shows 79: the first 64 and every encrypted or compressed one.

4,920 segments not drawn (3.3 MiB)02468Segment 0: 311,441 bytes, 5.82 bits per byteSegment 3: 25 bytes, 1.42 bits per byteSegment 6: 1,493 bytes, 7.04 bits per byteSegment 7: 399 bytes, 5.31 bits per byteSegment 9: 53 bytes, 1.24 bits per byteSegment 10: 13 bytes, 1.51 bits per byteSegment 11: 16,933 bytes, 5.43 bits per byteSegment 12: 389 bytes, 3.12 bits per byteSegment 13: 6,715 bytes, 5.38 bits per byteSegment 14: 873 bytes, 5.14 bits per byteSegment 15: 347 bytes, 4.41 bits per byteSegment 16: 43 bytes, 2.84 bits per byteSegment 17: 679 bytes, 3.75 bits per byteSegment 18: 651 bytes, 3.67 bits per byteSegment 19: 639 bytes, 3.75 bits per byteSegment 20: 663 bytes, 3.78 bits per byteSegment 21: 663 bytes, 3.72 bits per byteSegment 22: 982 bytes, 4.54 bits per byteSegment 23: 635 bytes, 3.66 bits per byteSegment 24: 635 bytes, 3.71 bits per byteSegment 25: 663 bytes, 3.78 bits per byteSegment 26: 631 bytes, 3.91 bits per byteSegment 27: 570 bytes, 3.58 bits per byteSegment 28: 639 bytes, 3.75 bits per byteSegment 29: 647 bytes, 3.77 bits per byteSegment 30: 570 bytes, 3.58 bits per byteSegment 31: 631 bytes, 3.71 bits per byteSegment 32: 635 bytes, 3.68 bits per byteSegment 33: 1,367 bytes, 3.91 bits per byteSegment 34: 631 bytes, 3.7 bits per byteSegment 35: 602 bytes, 3.53 bits per byteSegment 36: 611 bytes, 3.79 bits per byteSegment 37: 570 bytes, 3.58 bits per byteSegment 38: 635 bytes, 3.73 bits per byteSegment 39: 570 bytes, 3.55 bits per byteSegment 40: 570 bytes, 3.58 bits per byteSegment 41: 631 bytes, 3.69 bits per byteSegment 42: 655 bytes, 3.74 bits per byteSegment 43: 570 bytes, 3.55 bits per byteSegment 44: 570 bytes, 3.58 bits per byteSegment 45: 631 bytes, 3.71 bits per byteSegment 46: 647 bytes, 3.76 bits per byteSegment 47: 570 bytes, 3.58 bits per byteSegment 48: 631 bytes, 3.69 bits per byteSegment 49: 647 bytes, 3.77 bits per byteSegment 50: 570 bytes, 3.58 bits per byteSegment 51: 631 bytes, 3.68 bits per byteSegment 52: 647 bytes, 3.76 bits per byteSegment 53: 570 bytes, 3.58 bits per byteSegment 54: 635 bytes, 3.72 bits per byteSegment 55: 659 bytes, 3.78 bits per byteSegment 56: 570 bytes, 3.55 bits per byteSegment 57: 570 bytes, 3.58 bits per byteSegment 58: 631 bytes, 3.71 bits per byteSegment 59: 647 bytes, 3.76 bits per byteSegment 60: 570 bytes, 3.58 bits per byteSegment 61: 722 bytes, 3.64 bits per byteSegment 62: 647 bytes, 3.7 bits per byteSegment 63: 786 bytes, 4.15 bits per byteSegment 4: 2,543 bytes, 7.81 bits per byteSegment 531: 2,282 bytes, 7.69 bits per byteSegment 1036: 5,234 bytes, 7.94 bits per byteSegment 1080: 2,078 bytes, 7.78 bits per byteSegment 1102: 1,563 bytes, 7.98 bits per byteSegment 1212: 1,622 bytes, 7.52 bits per byteSegment 1214: 1,622 bytes, 7.52 bits per byteSegment 1226: 2,164 bytes, 7.74 bits per byteSegment 1252: 4,096 bytes, 7.74 bits per byteSegment 3177: 4,551 bytes, 7.93 bits per byteSegment 3178: 1,185 bytes, 7.6 bits per byteSegment 3194: 12,287 bytes, 7.71 bits per byteSegment 3295: 3,321 bytes, 7.75 bits per byteSegment 3300: 13,248 bytes, 7.89 bits per byteSegment 3301: 8,144 bytes, 7.84 bits per byteSegment 3969: 19,054 bytes, 7.72 bits per byte
data segment encrypted or compressed 4,920 segments not drawn 7.5 bits per byteHeight: bits per byte. Width: share of all the data.
  • Segment 4: 2,543 bytes at 7.81 bits per byte
  • Segment 531: 2,282 bytes at 7.69 bits per byte
  • Segment 1036: 5,234 bytes at 7.94 bits per byte
  • Segment 1080: 2,078 bytes at 7.78 bits per byte
  • Segment 1102: 1,563 bytes at 7.98 bits per byte
  • Segment 1212: 1,622 bytes at 7.52 bits per byte
  • Segment 1214: 1,622 bytes at 7.52 bits per byte
  • Segment 1226: 2,164 bytes at 7.74 bits per byte
  • Segment 1252: 4,096 bytes at 7.74 bits per byte
  • Segment 3177: 4,551 bytes at 7.93 bits per byte
  • Segment 3178: 1,185 bytes at 7.6 bits per byte
  • Segment 3194: 12,287 bytes at 7.71 bits per byte
  • Segment 3295: 3,321 bytes at 7.75 bits per byte
  • Segment 3300: 13,248 bytes at 7.89 bits per byte
  • Segment 3301: 8,144 bytes at 7.84 bits per byte
  • Segment 3969: 19,054 bytes at 7.72 bits per byte

Imports (231)

  • a.a
  • a.b
  • a.c
  • a.d
  • a.e
  • a.f
  • a.g
  • a.h
  • a.i
  • a.j
  • a.k
  • a.l
  • a.m
  • a.n
  • a.o
  • a.p
  • a.q
  • a.r
  • a.s
  • a.t
  • a.u
  • a.v
  • a.w
  • a.x
  • a.y
  • a.z
  • a.A
  • a.B
  • a.C
  • a.D
  • a.E
  • a.F
  • a.G
  • a.H
  • a.I
  • a.J
  • a.K
  • a.L
  • a.M
  • a.N
  • a.O
  • a.P
  • a.Q
  • a.R
  • a.S
  • a.T
  • a.U
  • a.V
  • a.W
  • a.X

Exports (16)

Text it passes to the page

Fixed text the module hands to the page's JavaScript when it calls an import, read from the module file. Imports that reach the network, run code or change the page come first; web addresses are shown as their host.

ImportText
a.Jans.adobe.com
a.JaKeywords
a.c{pop dX 0 lt{-1}{1}ifelse/dX exdef}
a.csform
a.d{/dY exdef}
a.jiiii
a.jcns.adobe.com
a.jcKeywords
a.k/BlueValues missing: FD[%ld]
a.kcns.adobe.com
a.kcKeywords
a.rruntime.defaultCameraChange = true
a.v(sfr) can't init lib

Hosts and scripts inside

www.adobe.com

In our sandbox

  • Produced 83 strings at run time, listed below.

Strings it produced at run time

Text that appeared while it ran and is not in the file: decoded, decrypted or built by its code. Web addresses are shown as their host. Showing 80 of 83.

  1. N5boost6detail15sp_counted_baseE
  2. central_parallel
  3. longitude_of_origin
  4. standard_parallel_2
  5. x_axis_rotation
  6. s_coordinate_of_rotation_origin
  7. y_axis_rotation
  8. y_coordinate_of_rotation_origin
  9. z_axis_rotation
  10. z_coordinate_of_rotation_origin
  11. CentralMeridian
  12. Central_Parallel
  13. Longitude_Of_Origin
  14. Standard_Parallel_2
  15. Equidistant_Cylindrical
  16. Hotine_Oblique_Mercator_Azimuth_Center
  17. Hotine_Oblique_Mercator_Azimuth_Natural_Origin
  18. Van_der_Grinten_I
  19. tvcmgpfdaehaehhxtmhpxamperp
  20. 20TTNameRecordsAndData
  21. CDATA[version
  22. $$$SUBSTITUTEBASE findfont dup maxlength 19 add dict begin/SubstMaster exch
  23. T)U)V)W)X)Y)Z)[)\)])^)_)`)a)b)c)d)e)f)g)h)i)j)k)l)m)n)o)p)q)r)s)t)u)v)w)x)y)z){)|)})~)
  24. RESETEUEVEWEXEYEZE[E\E]E^E_E`EaEbEcEdEeEfEgEhEiEjEkElEmEnEoEpEqErEsEtEuEvEwExEyEzE{E|E}E~E
  25. gJhJiJjJkJlJmJnJoJpJqJrJsJtJuJvJwJxJyJ
  26. KPLPMPNPOPPPQP
  27. qPrPsPtPuPvPwPxPyPzP{P|P}P~P
  28. (V)V*V+V,V-V.V/V0V1V2V3V4V5V6V7V8V9V:V;V<V=V>V?V@V
  29. BVCVDVEVFVGVHVIVJVKVLVMVNVOVPVQVRVSVTVUVVVWVXVYVZV[V\V]V^V_V`VaVbVcVdVeVfVgVhViVjVkVlVmVnVoVpVqVrVsV
  30. =y>y?y@yAyByCyDyEyFyGyHyIyJyKyLyMyNyOyPyQyRySyTyUyVyWyXyYyZy[y\y]y^y_y`yaybycydyeyfygyhyiyjykylymynyoypyqyrysytyuyvy
  31. E:F:G:H:I:J:K:L:M:N:O:P:Q:R:S:T:U:V:W:X:Y:Z:[:\:]:^:_:`:
  32. J=K=L=M=N=O=P=Q=R=S=
  33. [=\=]=^=_=
  34. ,F-F.F/F0F1F2F3F4F5F6F7F8F9F:F;F<F=F>F?F@FAFBFCFDFEFFFGFHFIFJFKFLFMFNFOFPFQFRFSFTFUFVF
  35. ;I<I=I>I?I@IAIBICIDIEIFIGIHIIIJIKILIMINIOIPIQIRISITIUIVIWIXIYIZI[I\I]I^I_I`IaIbIcIdIeIfIgIhIiIjIkIlImInIoIpIqI
  36. rIsItIuIvIwIxIyIzI{I|I}I~I
  37. 9K:K;K<K=K>K?K@K
  38. XLYLZL[L\L]L^L_L`LaLbLcLdLeLfLgLhLiLjLkLlLmLnLoLpLqL
  39. 2M3M4M5M6M7M8M9M:M;M<M=M>M?M@MAMBMCMDMEMFMGMHMIMJMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYM
  40. :N;N<N=N>N?N@NANBNCNDNENFNGNHNINJNKNLNMNNNONPN
  41. rOsOtOuOvOwOxOyOzO{O|O}O~O
  42. wRxRyRzR{R|R}R~R
  43. )d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dad
  44. PeQeReSeTeUeVeWeXeYe
  45. vewexeyeze{e|e}e~e
  46. hfifjfkflfmfnfofpfqfrfsftfufvfwfxf
  47. B{C{D{E{
  48. N3arf12GlyphMatcherE
  49. LC_CTYPE
  50. D_gsat_Greenwich
  51. WRS_INFO IP ID:<AdobeIP#A0001584>
  52. acegmnopqrsuvwxyz
  53. UUUUUUe@
  54. """3"D"U"f"w"
  55. 3"333D3U3f3w3
  56. D"D3DDDUDfDwD
  57. U"U3UDUUUfUwU
  58. f"f3fDfUfffwf
  59. w"w3wDwUwfwww
  60. !)1:BJRZcks{
  61. $(-159=AEIMQUY]aeimquy}
  62. ort/cmaps/
  63. ort/unicode/
  64. ort/FntNames.db
  65. Out of Memory
  66. 0x003ea5ac
  67. 0x003ea5a4
  68. 0x003f550c
  69. EndGroup
  70. GetPortColorSpace
  71. GetBuffer
  72. GetBounds
  73. GetByteWidth
  74. GetTileImage
  75. GetInjectionType
  76. GetEPSResourceServer
  77. GetFontPSStream
  78. InjectEPSContent
  79. $$$$$$$$$$$$$$$$$$$$$$$$$$HHHHHHHHHHHHHHHHHHHHHHHHHllllllllllllllllllllllllll
  80. 00030<0?0

Checks we ran

  • Threat-feed matches: none
  • Names of mining software or pools: none
  • CryptoNight mining structure: not found
  • Hashing or cipher loops: 15 functions (common in codecs and captchas)
  • Known hashing or cipher algorithms: AES, BLAKE2b, BLAKE2s or BLAKE3, Blowfish, CRC-32, ChaCha20, DES, MD5, MD5, SHA-1 or RIPEMD-160, SHA-1, SHA-1 or RIPEMD-160, SHA-256, SHA-512, SHA-512 or BLAKE2b, Salsa20 or ChaCha, Whirlpool
  • Encrypted or compressed data: 16 blocks, 83.0 KiB (2.2% of its data)
  • JavaScript stored inside: none
  • Other modules inside: none
  • Imports that read browser or page details: none
  • Function names: removed (usual in release builds)

Static checks of the file: nothing in it was run for these. A finding is a lead, not a verdict.

Shares code with

Other modules that contain some of the same functions. They are ranked by functions few modules have, so a language's own runtime does not link every module built with it. Shared code often means a shared library or the same developer. It is a lead, not a verdict.

  • 655cc4de…12c76c277.4 KiB · first seen 2026-10-11 · 80 functions in common (under 1% of this module's, 27% of that one's)

Seen on 1 public scan

PageTitleSeenHow it got there
acrobat.adobe.com90511890988 - Adobe cloud storage2026-10-27Downloaded as a file