How can a Javascript file drop .exe written in Visual Basic without network communication?

Question

I am analyzing a malicious JS file, which is obfuscated in a way that I could not de-obfuscate. When I executed it in a virtual machine and spectated process changes, I noticed that a new executable was created, which when acquired, turned out to be written in Visual Basic 6.

I know that JS droppers often are written to download the secondary malware but in this case, the exe is created without any network communication. Does that mean that the VB6 exe was packed in the original JS file? On a high level, how can this be implemented?

Answer 1

The executable is most likely embedded inside the javascript file itself, or of any accompanying files (say, an .html file that is downloaded with the javascript).

As Memo mentioned, the embedded executable can be encoded, obfuscated or even encrypted within the javascript file, where the javascript file will be required to decode, deobfuscate or decrypt it before writing it to disk and executing it.

Answer 2

Most probably the VB6 executable was base64 encoded and embedded as a string in the obfuscated code. Then decoded back into a binary at runtime.

https://developer.mozilla.org/en-US/docs/Web/API/WindowBase64/Base64_encoding_and_decoding