I am analyzing a malicious JS file, which is obfuscated in a way that I could not de-obfuscate. When I executed it in a virtual machine and spectated process changes, I noticed that a new executable was created, which when acquired, turned out to be written in Visual Basic 6.
I know that JS droppers often are written to download the secondary malware but in this case, the exe is created without any network communication. Does that mean that the VB6 exe was packed in the original JS file? On a high level, how can this be implemented?