This is a downloader designed for downloading and starting the Trojan encoder named BAT.Encoder.23. The downloader is distributed via mass spam mailings under the guise of a bill.
At first, it downloads the document.btc file, saves it to the %TEMP%\document.doc folder, and opens the file.
Then, it downloads the day.btc (libiconv), null.btc (GPG) and sad.btc (Sysinternals Sdelete) files and saves them to the %TEMP% folder.
Next, it downloads the keybtc.btc file (BAT.Encoder.23), saves it to the %TEMP%\keybtc.cmd folder, and starts the Trojan.