Attachment: PDF with link to zip containing a wsf file

type.inbound
and any(attachments,
        .file_type == "pdf"
        and any(file.explode(.),
                any(.scan.url.urls,
                    strings.icontains(.url, "zip")
                    and any(ml.link_analysis(.).files_downloaded,
                            any(file.explode(.), .file_extension == "wsf")
                    )
                )
                or any(.scan.url.urls,
                       strings.icontains(.url, "php")
                       and any(ml.link_analysis(.).files_downloaded,
                               any(file.explode(.),
                                   .file_extension == "zip"
                                   and any(.scan.zip.attempted_files, strings.icontains(., "wsf"))
                               )
                       )
                )
        )
)