f5 shape

f5 shape (formerly shape security, sometimes called shape defense). loader is site-deployed and rotates frequently. one of the more aggressive obfuscation profiles in the market.

  • shape loader (hertz tenant)

    [ok]

    https://www.hertz.com/A-thou-doe-prospeeceiud-accome-Hauen-heeleepell-

    last ran
    2026-05-19 22:32 utc
    (2d ago)
    last updated
    2026-05-19 22:32 utc
    (2d ago)
    size
    854.4kb
    sha256
    25cc11156243
    apis touched
    47
    47 raw
    bot tells
    1
    sinks
    0
    0 leaked
    hazards
    3
    structural
    0
    anti-debug
    0
    L3/L4 hazards
    consistency
    0
    cross-checks
    providers
    0

    categories probed (6)

    click a row to drill into every api the script probes in that category.

    • [+] workers2 apis · 1 tells · 7 hits
      • [+] importScriptsmedium · bot-tell×1
        details + source hits (1)
      • [+] Bloblow×6
        details + source hits (6)
    • [+] timing2 apis · 0 tells · 27 hits
      • [+] requestAnimationFramelow×3
        details + source hits (3)
      • [+] Dateinfo×24
        details + source hits (24)
    • [+] events1 apis · 0 tells · 3 hits
      • [+] *.locationinfo×3
        details + source hits (3)
    • [+] storage1 apis · 0 tells · 4 hits
      • [+] localStoragelow×4
        details + source hits (4)
    • [+] anti-debug1 apis · 0 tells · 4 hits
      • [+] consolelow×4
        details + source hits (4)
    • [+] introspection1 apis · 0 tells · 2 hits
      • [+] *.toStringlow×2
        details + source hits (2)

    bot-detection tells (1)

    strong indicators of bot-detection intent. drill into the categories section below to inspect description, evasion notes, and source snippets for any tell.

    • importScripts ×1

    dynamic-execution hazards (3)

    anywhere the script puts code beyond static reach. eval, function, document.write, dynamic import. these are the holes script2builtins-runtime would fill.

    • FunctionL2:106234

      `Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      Function(_0x5a243a(0x5d9)+_0x5a243a(0x433))
    • FunctionL2:118957

      `Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      Function(_0x58d828(0x5d9)+_0x58d828(0x433))
    • FunctionL2:146010

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function(_0x2634a9(0x5d9)+_0x2634a9(0x433))