Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently it seems there has been a big outbreak of zip files being emailed to people with a .js file containing code that downloads and executes cryptoware.

How does the .js actually get executed though? Do users have to execute the javascript file itself after extracting it or is it somehow possible to make the javascript file execute upon extraction? I am rather confused on how this causes so many infections.


share|improve this question
The JS is named something like "list of employees to be fired" and human stupidity does the rest. ;) – André Borie Mar 28 at 22:11
@paulburkeland seems unlikely. Code execution exploits are common in complex applications like web browsers but I would assume basic stuff like file/archive managers are now robust enough. In this case I'm suspecting they're lying as they don't want to end up on the now real "list of employees to be fired". – André Borie Mar 29 at 2:30
completely off topic, but wouldn't "cryptomalware" better express what is happening? Wouldn't it be disturbing to see spreading use of a legitimate-sounding word like "cryptoware" for something that is bound to be associated with something wrong like malware? I'm not comfortable with the literature but this is wrong. – n611x007 Mar 29 at 7:14
Very often, the file will be named Something Tempting.jpg.js. The default in Windows (the stupidest ever decision by Microsoft) is to hide extensions ("they're too techie") so the user sees Something Tempting.jpg, thinks it's just an image, and opens it, not realising they're really running some Javascript. – TripeHound Mar 29 at 12:57
@ChrisH Yeah, there is an enormous amount of ways to fool an unsuspecting user. I guess there's also some luck involved in the user actually taking the bait. – Kamen Minkov Mar 29 at 15:26
up vote 21 down vote accepted

Do you remember "I love you" ?

Human curiosity often does the trick, unarchiving the zip and then executing the JS.

There are more than enough people that do want to be sure they didn't miss a payment and will be cut off their mobile phone soon.

A fundamental unawareness of how email works is another great factor here:

The email comes from Tom! And he says I should have a look. Tom always shares funny images on facebook, let's see!

Completely unaware of email-sender spoofing (which shouldn't be a problem with DKIM, SPF, S/MIME and PGP around, but that's another story), those users just trust the sender and open the files.

INORITE? But that's just human curiosity bundled with fatal lack of knowledge.

share|improve this answer
Good answer, but I don't remember what "I love you" is. Could you add a link to some info on it? Googling "I love you" doesn't really turn up anything useful. – ymbirtt Mar 29 at 7:36
There you go, @ymbirtt – SmokeDispenser Mar 29 at 7:40
I suggested an edit to add the link to the answer (since comments are ephemeral). – Oliphaunt Mar 29 at 12:41
I fast-track approved that, thanks. – SmokeDispenser Mar 29 at 12:42
@ymbirtt That's a really interesting wikipedia article. It's crazy they ended up walking away from it too. Thank you for that! – Austin Mar 29 at 13:44

The same user who clicks on the ZIP-file to extract the JS-file also clicks the JS-file.

This will launch the Windows Script Host to execute the script (it runs both JScript (JS and JSE) and VBScript (VBS and VBE)). The scripts run by WSH are not sandboxed in the way they would be in a browser.

Launching a JS in this manner is pretty much the same as launching an EXE.

share|improve this answer
But what does that do, open it in a web browser? Where... it's still sandboxed in the browser sandbox? – Michael Mar 29 at 1:43
@Michael Windows has its own JS runtime that is by default associated with .js files and has different rules in terms of sandboxing. I haven't looked into that in depth but from having seen some malicious .js files in the wild I can assume they're at least able to do file I/O and call other binaries. – André Borie Mar 29 at 2:32
@AndréBorie I don't think there is a sandbox in Windows Script Host. It's really for automation, akin to running an untrusted cmd, PowerShell, sh, bash, AppleScript, etc., script. There are ways to lock it down some, but that's not default. – Bob Mar 29 at 2:40
Ah, I wasn't aware of Windows Script Host. Interesting... – Ajedi32 Mar 29 at 18:01

Windows Script Host is an automation technology that provides scripting abilities. It is language-independent in that it can make use of different Active Scripting language engines.

By default, Windows interprets and runs JScript (.js and .jse files) and VBScript (.vbs and .vbe files).

Clicking a .js file will make wscript.exe interpret it and the script can do anything. For example, this pops up calc:

var shell = WScript.CreateObject("WScript.Shell");

There have been methods or vulnerabilities that allowed automatic execution without (directly) opening the malicious file, like DLL hijacking and sideloading. But, to my knowledge, there is no new method or vulnerability actively exploited in the wild. Such a method would be very effective at spreading malware and would quickly get public notice.

share|improve this answer

IIRC you can't make the files auto-execute easily (There may be ways, but most of these attacks do not rely on them).

Very uninformed people (the majority of pc users) have no issues clicking files though usually, and doing so with a .js file will on most pcs (unless sufficiently locked down) run them in the default Windows JS RE.

share|improve this answer
"IIRC you can't make the files auto-execute." - I advise you to be very careful before saying "you can't when talking about security. There were and still are many hideous ways of tricking computers to auto execute malicious code. This question wasn't the case, but that doesn't mean you can say "you can't". – Tomáš Zato Mar 29 at 8:18
@TomášZato good point, I edited the answer to reflect that. – Magisch Mar 29 at 8:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.