user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat PUA:Win32/Adsunwan
PUA:Win32/Adsunwan - Windows Defender threat signature analysis

PUA:Win32/Adsunwan - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: PUA:Win32/Adsunwan
Classification:
Type:PUA
Platform:Win32
Family:Adsunwan
Detection Type:Concrete
Known malware family with identified signatures
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: PUA for 32-bit Windows platform, family Adsunwan

Summary:

PUA:Win32/Adsunwan is a sophisticated Potentially Unwanted Application that employs a wide array of techniques for persistence, evasion, and system manipulation. It leverages legitimate Windows utilities like mshta, regsvr32, rundll32, PowerShell, and BITS jobs to establish persistence, execute code, and transfer files. The threat also utilizes advanced capabilities such as API hooking and data encoding to evade detection and maintain control.

Severity:
High
VDM Static Detection:
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
640088274eee03faab19c4296764a66a3c2efd9023fcf8be677a117d7725df00
07/12/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the affected system immediately. Perform a full system scan with updated antivirus software (e.g., Windows Defender) and remove all detected components. Manually check for and remove any established persistence mechanisms like scheduled tasks, startup entries, or modified registry keys.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 07/12/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊