See: https://www.virustotal.com/url/25e21076e9fc650e837abbc0ac4538b6c0dddc44a19b6cbfeb2130e9d661056b/analysis/1355009084/ one of the many instances launched from that particular domain
and detected by avast here as BV:Bicololo-BM [Trj]: https://www.virustotal.com/file/30f77c3a0a9b2ddf48c52c39d382039f3cc991800599d39208514bb3f5e31bfa/analysis/1355009086/
Avast protects us against this VBS malware,
polonus