Open-source atomic malware analysis

Analyze another

node_modules/@yakult-green-tea/qq-music-api/dist/src/services/auth/qrLogin.js

UNKNOWN
Verdict: BENIGN
Mal-ecule
O(Co)H₃(Cm₁₂Cr₄Db₄)Md(Pa)
Size 61.0 KB download
First seen 7 days ago
Analyzed 3 days ago
Ecosystem arch

Found in 1 archive

Referenced by 1 sample

qrLogin.js javascript
6:409 = void 0;
7 const node_crypto_1 = __importDefault(require("node:crypto"));
8 const logger_1 = require("../../util/logger");
9 const deviceContext_1 = require("./deviceContext");
10 const httpClient_1 = __importDefault(require("./httpClient"));
11 const wechatLogin_1 = require("./wechatLogin");
12 const WebSocketRuntime = require('ws');
13 const MUSICU_URL = 'https://u.y.qq.com/cgi-bin/musicu.fcg';
14 const QIMEI_URL = 'https://api.tencentmusic.com/tme/trpc/proxy';
15 // Public Android client protocol constants, not user credentials.
16 const QIMEI_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
17 MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEIxgwoutfwoJxcGQeedgP7FG9qaIuS0qzfR8gWkrkTZKM2iWHn2ajQpBRZjMSoSf6+KJGvar2ORhBfpDXyVtZCK
242:65 and `ws.stream` answer 403.
243 */
244 const DEFAULT_STREAM_DOMAIN = 'http://dl.stream.qqmusic.qq.com/'; Contains a hardcoded insecure HTTP URL
245 const MUSIC_FILE_TYPES = {
246 m4a: { prefix: 'C400', extension: '.m4a' },
247 128: { prefix: 'M500', extension: '.mp3' },
248 320: { prefix: 'M800', extension: '.mp3' },
249 ape: {
292:10 eturn {};
293 try {
294 return dictionaryOf(JSON.parse(value));
295 }
296 catch {
297 return {};
298 }
299 };
300 const md5 = (...values) => {
301 const hash = node_crypto_1.default.createHash('md5');
302 for (const value of values)
303 hash.update(value);
304 return hash.digest('hex');
305 };
306 const randomHex = (length) => node_crypto_1.default
307 .randomBytes(Math.ceil(length / 2))
308 .toString('hex')
309 .slice(0, length);
310 const randomDigits = (length) => {
311 let
371:68 `,
372 qimei: '',
373 qimei36: '',
374 sdkVersion: '1.2.13.6',
375 targetSdkVersion: '33',
376 audit: '',
377 userId: '{}',
378 packageId: PACKAGE_ID,
379 deviceType: 'Phone',
380 sdkName: '',
381 reserved: JSON.stringify(reserved),
382 };
383 };
384 const buildQimeiRequest = (device, now = new Date()) => {
385 const cryptKey = randomHex(16);
386 const no
387:18 mp = Math.floor(now.getTime() / 1000);
388 const encryptedKey = node_crypto_1.default.publicEncrypt({ key: QIMEI_PUBLIC_KEY, padding: node_crypto_1.default.constants.RSA_PKCS1_PADDING }, Buffer.from(cryptKey));
389 const cipher = node_crypto_1.default.createCipheriv('aes-128-cbc', Buffer.from(cryptKey), Buffer.from(cryptKey));
390 const encryptedPayload = Buffer.concat([
391 cipher.update(Buffer.from(JSON.stringify(buildQimeiPayload(device, now)))), Creates Node.js Buffer from JSON serialization
392 cipher.final(),
393 ]);
394 const key = encryptedKey.toString('base64');
395 const params = encryptedPayload.toString('base64');
396 const extra = `{"appKey":"${QIMEI_APP_KEY}"}`;
397 return {
398

Objectives

Micro-behaviors

Metadata

20 of 24 traits shown

Identity

SHA-256 f79a94c50b456781b8d29b865bd0cc7fe1a3904d1e685c9ab7fbfac7f57ac70d
Filename node_modules/@yakult-green-tea/qq-music-api/dist/src/services/auth/qrLogin.js

Origin

Source x
Feed aur.archlinux.org
Ecosystem arch

Timeline

First seen 19 Aug 2026 15:06 UTC
First analyzed 19 Aug 2026 15:08 UTC
Last analyzed 23 Aug 2026 12:59 UTC
Last updated 23 Aug 2026 13:00 UTC

Labeling

Label unknown