user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:JS/GuLoader.PA!MTB
Trojan:JS/GuLoader.PA!MTB - Windows Defender threat signature analysis

Trojan:JS/GuLoader.PA!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:JS/GuLoader.PA!MTB
Classification:
Type:Trojan
Platform:JS
Family:GuLoader
Detection Type:Concrete
Known malware family with identified signatures
Variant:PA
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for JavaScript platform, family GuLoader

Summary:

Trojan:JS/GuLoader.PA!MTB is a sophisticated JavaScript-based malware loader, detected by concrete machine learning behavioral analysis, designed to evade detection and deliver secondary malicious payloads. It extensively abuses legitimate system tools like mshta, regsvr32, rundll32, PowerShell, and BITS, employs process hooking, persistence via scheduled tasks, and data encoding. This variant performs actions such as remote file copying and file deletion, indicating a comprehensive and stealthy attack chain.

Severity:
High
VDM Static Detection:
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: IMG2026-01-15-3472.js
35e985ce8f9bab835fee28778970384d9f893b2dce4a23e134a47841fbd73155
16/01/2026
→VirusTotal↓Download Sample
Filename: Xerox Scan_12012026135517.js
ab8deae8424265485d0c8f5ab56ad1f62936cf9034b9ad9eaea5730fbf0d7a06
16/01/2026
→VirusTotal↓Download Sample
Filename: 2026-01-15-9472.js
dfd80c7deb4bca838389f8078ce3e3b6231139f45e6e919bccfb7cdfa60046f1
16/01/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the infected system to prevent further compromise. Perform a full system scan with updated antivirus/EDR, thoroughly investigate for secondary infections or persistence mechanisms (e.g., scheduled tasks, registry modifications), and remove all identified malicious artifacts. Apply all available security patches, enhance endpoint security controls, and reinforce user awareness training to mitigate future risks.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 16/01/2026. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊