Eleven files, 1.23 MB of code, one phishing product. Every row links to the exact bytes served by
web.mis-ws.org on capture day — click to download rather than open, because they are minified on purpose.
a0_0x10903e, every literal replaced by an index into a shuffled array that is decoded through a self-defending rotation loop.
Opening a chunk in a tab shows you that array, not the program. The readable version comes from resolving the 13,449 substitution calls —
that is what the teardown walks through.| File | Size | SHA-256 | What it is |
|---|---|---|---|
| index.html index.html/ | 2 KB | 5782652f5429f9c2 | Shell Entry document. Server-side gate markers: five noindex metas, mobile-only precondition, the app root and the gate script tags. |
| mrdoZ7lOmsmiO2EK.js llFco8/ | 6 KB | d3f72dc47645dd4d | Entry chunk First JS executed. Wraps everything in an anti-debug IIFE (webdriver / devtools-timing / window-size checks) and mounts the boot component. |
| rMMvYjUC2OMjmaUv-CxxESmdC.js llFco8/ | 7 KB | 0421a110d1c077b8 | Stage-2 loader Second loader, own rotated string table. Sequence-walks its own decode table before continuing. |
| Ya0GiQViKSAoSBPd-CzaoCS8e.js llFco8/ | 7 KB | 89ed09d4df0785dc | Gate + dep map Installs the gate, then dynamically imports the Vue app with its CSS dep map. |
| xSgpjQlwJiVazovM-C7bOig6j.js llFco8/ | 9 KB | 3082acd72aab307f | Preload helper Tiny module-federation-style resolver: builds asset URLs, resolves them against import.meta, injects them as modulepreload links. |
| mgate.js llFco8/ | 3 KB | 582ea1f36e9007ca | Client gate Decides whether the visitor is a real phone: UA regex, platform, WebGL renderer allow/deny list, navigator.userAgentData.mobile, WebDriver. |
| 6pHhaKvzZfqoKOjN-DpnwfnMB.js llFco8/ | 1.14 MB | 6f70035c3a8cd76c | Vue application The product. 1.19 MB: Vue 3 runtime, four locales, the whole bot script, the fake-chat UI, the pairing client and the operator-chat API client. |
| GbdDzTQ6mWpLgsXz.css llFco8/ | 53 KB | e98648c1995ffe2c | Stylesheet Reproduces WhatsApp's visual language: bubble radii, tail geometry, header green, timestamp typography, system-font stack. |
| script.js script.js/ | 5 KB | 5da9e457232b0fb1 | Analytics Umami, third-party. Loaded by the shell; the archive guard blocks its beacon so nothing reports anywhere. |
| guard.js guard.js/ | 5 KB | ee2a8a5e5c43b54b | ADDED BY ME Not part of the kit. Spoofs the phone signals the gate wants, pins /llFco8/ asset paths into this folder, and blocks every outbound request. |
13 images (2.07 MB): the four warning illustrations, the service-menu graphic and the phone-settings screenshots the bot script shows at each stage, in zh-CN / zh-HK / en-US variants. Served as WebP with hash filenames from the same folder.
Archive of a criminal kit, kept inert: guard.js blocks every outbound request, so this copy cannot pair, poll or report.
Analysis at the teardown.