user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat PUA:Win32/Packunwan
PUA:Win32/Packunwan - Windows Defender threat signature analysis

PUA:Win32/Packunwan - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: PUA:Win32/Packunwan
Classification:
Type:PUA
Platform:Win32
Family:Packunwan
Detection Type:Concrete
Known malware family with identified signatures
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: PUA for 32-bit Windows platform, family Packunwan

Summary:

PUA:Win32/Packunwan is a sophisticated Potentially Unwanted Application (PUA) detected with concrete signatures. It exhibits extensive capabilities for system compromise, including process hooking, leveraging legitimate Windows utilities for execution and persistence (e.g., mshta, regsvr32, rundll32, PowerShell, scheduled tasks), and functionalities for remote file operations, data encoding, and file deletion. This PUA poses a significant risk due to its deep system manipulation and evasion techniques.

Severity:
High
VDM Static Detection:
Relevant strings associated with this threat:
 - *=s\< (SNID)
 - dDH\"i (SNID)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: 2e6346ce1adf15bffca31a0c96274f615e3e0bbf53235e4b4c85555bc012b9d9.exe
2e6346ce1adf15bffca31a0c96274f615e3e0bbf53235e4b4c85555bc012b9d9
31/01/2026
→VirusTotal↓Download Sample
Filename: ProtoInputLoader64.dll
3d06251735184814c5eb1f1b3825ee005073e1e53cbbd4ec01d2a44c2e603315
28/01/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected system from the network. Perform a full system scan with updated antivirus/anti-malware software, remove all detected components, and review system logs for any signs of further compromise or persistence mechanisms (e.g., scheduled tasks, registry modifications). Consider a system re-image if deep infection is suspected.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 28/01/2026. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊