Hi Pondus,
This malware has been with us since 2009, examples: perm.aif.ru/i/js/translit.js & auto.sakh.com/js/translit.js and i.li.ru/translit.js
Here avast flags: http:// jsunpack.jeek.org/dec/go?report=4163b2e64c8ac0da90d1ecdec63ba648c922c673 as JS:IFrame-AU[Trj]
polonus