Known infection source or possibly harmless file?

Re: http://urlquery.net/report.php?id=1492703756595 seen as malware.
Flagged: https://www.virustotal.com/pl/url/a193e81a2e6e60d41609f4f8def579b5bf5a129a93edf92e8ca7619482cdc78f/analysis/1492704741/
Re: https://www.virustotal.com/pl/file/47575ea53e11ee97047c3da5f7c6d955d636a50331a63c0a4ecb1eda3ba71f01/analysis/1491971059/

javascript malware detected: https://sitecheck.sucuri.net/results/13524.r98.ir
http://www.domxssscanner.com/scan?url=http%3A%2F%2F13524.r98.ir%2Fjs%2Fsite.js
loading failed: http://retire.insecurity.today/#!/scan/220660abafbda7e4dc287cbb6423f9a6942910e0fc4ae25aebf2493cfd0c811f

Suspicious script and redirects: -https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=13524.r98.ir&ref_sel=GSP2&ua_sel=ff&fs=1

Checking for cloaking
There is a difference of 1 bytes between the version of the page you serve to Chrome and the version you serve to GoogleBot. This probably means some code is running on your site that’s trying to hide from browsers but make Google think there’s something else on the page.

IP badness history: https://www.scumware.org/report/79.127.127.68.html

polonus