[exim] How to get undecoded raw message header during ACL?

I'm trying to block certain spam emails from China. As I cannot block
on MIME type nor blacklist IP geographically because I have clients
based in China who do send legit emails in Chinese, the next best
alternative appears to be checking for a match against a specific
GB2312 string that exists in every From Header. But my deny condition
in the ACL doesn't appear to have any effect despite testing ok on the
command line.

Inside exim.conf:
being acl
deny message = Chinese Spam rejected
        condition = ${if
match{$message_headers_raw}{=[?]GB2312[?]B[?]x[+]vXqs/gudiyv8PF}{yes}{no}}

when I test the condition using commandline against a copy of one of
the spam messages, it works

# exim -bem /tmp/testspam2 '${if
match{$message_headers_raw}{=[?]GB2312[?]B[?]x[+]vXqs/gudiyv8PF}{yes}{no}}'
Return-path taken from "Return-path:" header line
yes


I'd appreciate it greatly if somebody could point out what I am doing
wrong here.