Attachment: Encrypted PDF with credential phishing link

type.inbound
and any(attachments,
        any(file.explode(.),
            .scan.encrypted_pdf.cracked_password is not null
            and strings.icontains(body.current_thread.text,
                                  .scan.encrypted_pdf.cracked_password
            )
        )
        and any(file.explode(.),
                length(.scan.url.urls) <= 3
                and any(.scan.url.urls,
                        network.whois(.domain).days_old < 90
                        or any(ml.nlu_classifier(ml.link_analysis(.,
                                                                  mode="aggressive"
                                                 ).final_dom.display_text
                               ).intents,
                               .name == "cred_theft" and .confidence != "low"
                        )
                )
        )
)