Attachment: JavaScript file with suspicious base64-encoded executable

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_common_archives
          or .file_extension in ("js", "jar")
        )
        and any(file.explode(.),
                (
                  (
                    .file_extension in ("js", "jar")
                    or any(.flavors.yara, . == "javascript_file")
                  )
                  and any(.flavors.yara, . == 'base64_pe')
                )
        )
)