Background - SocGholish

According to Mandiant, Socgholish was first spotted in the wild in December of 2017 as part of a fake browser update campaign.
Depending on what browser the user is using (presumably determined by their user-agent), they are prompted to download and install the latest version. Here's an example:

Originally, the payload was delivered as a .js file inside of a .zip archive, but over time, researchers began to see it being delivered in the wild as a plain .js file.
Socgholish has been known to use an interesting technique to bypass detection based on string-matching. The threat actors replace characters in the file name with "lookalikes" from other languages.
RedCanary writes:

Proofpoint writes that historically, the end of the attack chain has typically concluded with either Cobalt Strike or various RATs, and sometimes ransomware.

Analysis

After unzipping the sample and opening it in Visual Studio Code, it is visibly much smaller than a Gootloader script. This one comes in at only 76 lines of code.

It is clearly obfuscated, but not too heavily.
The script constructs a URL, sends HTTP POST requests, and processes the response.
Lastly, it uses eval to execute the response of the request function, which presumably executes the code returned by the C2 server.

Once de-obfuscated, the URL it communicates with is 168c39dd[.]apps.weightlossihp[.]com.

Summary

This specimen is a typical Socgholish sample that arrives to the end user as a .js file which, when executed via cscript, de-obfuscates the C2 URL and begins to communicate with 168c39dd[.]apps.weightlossihp[.]com over HTTP.