I started with running the URL through VirusTotal, which scored 0/46 - so it was something of interest and not being detected by Anti-Virus software (at least statically). Next I tried running it through jsunpack to see if it could make any sense of it - no luck, it broke the parser.
After digging around for a few minutes I was able to determine that the bit of code I really carded about was this:
In this case
e had been aliased to
a was a string that had been manipulated by the various functions at the beginning of the file (and passed around via a series of misleading assignments).
To quickly get the value of
a I modified the code to Base64 encode it and output the value, and then opened the HTML file in Chrome on a VM (disconnected from the network):
This was able to get me the value I was looking for, but the process took too long - and if I had missed another
eval it's possible that I could have executed what was clearly malicious code. So I was able to get what I needed and identify the malware that it was trying to drop - but the process was too slow and risky.
I'd be interesting in hearing about other tools and techniques for dealing with this kind of code.