XWorm Attack Chain: JavaScript, PowerShell, Reflective .NET Loader
The XWorm chain, from an obfuscated JavaScript dropper through PowerShell to a reflective loader that injects into MSBuild.
1 malware analysis write-up tagged reflective-loading.