user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat PUA:Win32/Spigot
PUA:Win32/Spigot - Windows Defender threat signature analysis

PUA:Win32/Spigot - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: PUA:Win32/Spigot
Classification:
Type:PUA
Platform:Win32
Family:Spigot
Detection Type:Concrete
Known malware family with identified signatures
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: PUA for 32-bit Windows platform, family Spigot

Summary:

PUA:Win32/Spigot is a Potentially Unwanted Application primarily functioning as a browser hijacker and adware. It modifies browser settings, installs unwanted extensions (e.g., 'mybrowserbar.com' in Firefox), and leverages legitimate Windows utilities like rundll32, PowerShell, and scheduled tasks for execution, persistence, and system interference through hooking mechanisms.

Severity:
High
VDM Static Detection:
Relevant strings associated with this threat:
 - \Spigot (FOLDERNAME)
 - \Mozilla\Firefox\Profiles\????????.default\extensions\pdfforge@mybrowserbar.com (FOLDERNAME)
 - XH.<> (SNID)
 - F.T#:i (SNID)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
5c196829f37d2efe5ee50771e5feed612b8651d2d7a984b24f2f80fbcf84f9d9
03/01/2026
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the affected system. Perform a full, updated antivirus scan to remove the PUA and associated components. Manually review and remove any suspicious browser extensions (particularly in Firefox), then reset affected web browsers to their default settings. Additionally, check for and remove any suspicious scheduled tasks or startup entries.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 03/01/2026. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊