Attachment: Emotet heavily padded doc in zip file

type.inbound
and any(attachments,
        .file_extension == "zip"
        and any(file.explode(.),
                .depth == 0
                and .size < 1000000
                and not .depth > 0
                and strings.ends_with(.scan.exiftool.zip_file_name, ".doc")
                and .scan.exiftool.zip_uncompressed_size > 500000000
        )
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)