Domains used in this attack:
blaackhatt58.us.to<br /> heidiheernande.us.to<br /> gufmaurr79.us.to/kwizhveo.php<br /> (and many others)
Any web site (no specific target).
Malware dump (sample of malware):
<iframe src="http://blaackhatt58.us.to/kwizhveo.php" ..