In reply to Maher Abdelshkour.

I agree entirely. I think this is possibly why the attackers chose this technique. This is also a very good example of why it is important to perform anti-virus detection at the network level. Appliances such as WSA can detect these files while they are in the process of being downloaded, but once the malware has modified the victim's browser they are much more difficult to detect.