JavaScript loader decodes embedded base64 blob at runtime

Renata Cardoso@rcardososec

•updated Aug 10, 2026•1•0•3

Detects the execution of JavaScript files via Windows Script Host (wscript.exe or cscript.exe) where the command line contains an unusually long base64-encoded string. This pattern is often indicative of a dropper or loader script deobfuscating and executing a subsequent malicious payload in memory.