A ZIP file with JavaScript inside is commonly used in current attacks with ransomware (cryptolocker etc). Giving the decoding done by squeamish ossifrage in another response here the structure matches what can be seen from other cryptolocker attacks:

• ZIP file inside mail
• containing Javascript - this gets locally stored and thus has different capabilities than script stored from the web. This file is only the Dropper.
• The real malware is downloaded from somewhere else
• Windows Scripting Host is used to store the download locally and then execute it

A ZIP file with JavaScript inside is commonly used in current attacks with ransomware (cryptolocker etc). Giving the decoding done by squeamish ossifrage in another response here the structure matches what can be seen from other cryptolocker attacks:

• ZIP file inside mail
• containing Javascript - this gets locally stored and thus has different capabilities than script stored from the web. This file is only the Dropper.
• The real malware is downloaded from somewhere else
• Windows Scripting Host is used to store the download locally and then execute it