Attachment: PDF with base64 JavaScript and eval functions

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            .depth == 0
            and any(.scan.yara.matches, .name in ("pdf_b64_js_var_eval", ))
        )
)