Link: Multistage landing - Abused Adobe Acrobat hosted PDF

type.inbound
and any(body.links,
        .href_url.domain.domain == "acrobat.adobe.com"
        and strings.istarts_with(.href_url.path, '/id/urn:')
)
and length(distinct(filter(body.links,
                           .href_url.domain.domain == "acrobat.adobe.com"
                           and strings.istarts_with(.href_url.path, '/id/urn:')
                    ),
                    .href_url.url
           )
) == 1
and any(filter(body.links,
               .href_url.domain.domain == "acrobat.adobe.com"
               and strings.istarts_with(.href_url.path, '/id/urn:')
        ),
        any(ml.link_analysis(., mode="aggressive").additional_responses,
            (
              any(file.explode(.file),
                  any(.scan.exiftool.fields,
                      // password protected pdf
                      .key == "Warning"
                      and strings.icontains(.value, "password protected")
                  )
              )
              // a low amount of links
              or (
                any(file.explode(.file), 1 <= length(.scan.url.urls) <= 2)
                // a single page
                and any(file.explode(.file),
                        .scan.exiftool.page_count == 1
                        // occurs when there are exif errors
                        or .scan.exiftool.page_count is null
                )
                // susipicious indicators
                and (
                  // logo detection of brands for file sharing companies
                  any(ml.logo_detect(.file).brands,
                      .name in ("DocuSign", "Adobe")
                      or strings.istarts_with(.name, 'Microsoft')
                  )
                  // look at the OCR of the document as well
                  or (
                    length(beta.ocr(.file).text) < 750
                    and (
                      regex.icontains(beta.ocr(.file).text, 'e-sign(?:ature)?')
                      or regex.icontains(beta.ocr(.file).text,
                                         'shared\s*a\s*document',
                                         'review\s*and\s*sign',
                                         'PDF\s*viewer',
                                         'display\s*this\s*type\s*of\s*document',
                                         'please\s*wait\.\.\.',
                                         'New\s*PDF\s*Document',
                                         'view\s*document',
                                         'open\s*the\s*secure\s*review\s*session'
                      )
                    )
                  )
                )
              )
            )
        )
)
and length(headers.references) == 0
and headers.in_reply_to is null