How does malware downloaded by JavaScript get executed, and why would you distribute malware in a .js file?

Question

I have two questions about JavaScript as an infection vector. The first one is about a user getting infected while visiting a website, and the second is about getting infected by e-mail via attachment.

1) Even if the malware is successfully downloaded by the user, wouldn't he still have to execute it himself to infect his system?

I'm talking about a case where no security holes in plugins like Flash or Java are used. The user would at best have a binary file in his downloads folder, maybe without even knowing it's there. Then what?

2) In malicious emails, why would you send a .js file as attachment that'll download the malware rather than the malware itself directly ?

I've even read about JS files in zip archives. Why? Most tech-illiterate people wouldn't know how to unzip a file and then try to open the document.

Answer 1

Even if the malware is successfully downloaded by the user, wouldn't he still have to execute it himself to infect his system ?

In the case that no exploit was used the malware has to downloaded and explicitly executed by the user. This is usually done via social engineering, i.e. declare the software as an software update or necessary plugin to view some illegal content, as an antivirus needed to resolve an immediate problem (scareware) or the malware is simply bundled with some software the user likes to use.

In malicious emails, why would you send a .js file as attachment that'll download the malware rather than the malware itself directly ?

The current wave of malware in mails uses .js (or less often .vbs and .wsf) in an archive (mostly .zip). If the file gets extracted from the archive and executed it will not be executed by the browser but by the windows scripting host (WSH). WSH has not the restrictions and safety measures of the browser which means the WSH program can download the file and immediately execute it without needing manual interaction by the user.

Having a .js is more innocent than a .exe or .com as attachment and the chance that it gets blocked by the antivirus is smaller. And usually the .js files are heavily obfuscated and it is impossible to declare a fixed signature for the file or even have a reliable execution inside a sandbox. Additionally the executable file often gets served by the webserver with an innocent content type (i.e. claims to be in image) so that it does not get scanned by the firewall.