Javascript malware hosted on US government site which launches powershell to connect to C2.
hxxp://dms(dot)nwcg(dot)gov/pipermail/ross-suggestion/attachments/20170304/9ee8a89e/attachment.zip
VT link : https://virustotal.com/#/file/1e6851e6e0ff2e0e430e882c8326334471ab2e35ebbac4104bd2aa27128ea6bd/detection

Credits : Ankit Anubhav from NewSky Security ( twitter : ankit_anubhav )