Attachment: PDF with suspicious language and redirect to suspicious file type

type.inbound
and any(attachments,
        .file_type == "pdf"
        and any(file.explode(.),
                length(.scan.url.urls) > 0
                and any(ml.nlu_classifier(.scan.ocr.raw).intents,
                        .name == "cred_theft"
                        and .confidence in~ ("medium", "high")
                )
                and any(.scan.url.urls,
                        strings.icontains(ml.link_analysis(.).final_dom.display_text,
                                          "Redirect Notice"
                        )
                        and (
                          strings.contains(ml.link_analysis(.).final_dom.display_text,
                                           ".zip"
                          )
                          or strings.contains(ml.link_analysis(.).final_dom.display_text,
                                              ".php"
                          )
                        )
                )
        )
)