Link to auto-downloaded file with Adobe branding

type.inbound
and any(body.links,
        // There are files downloaded
        length(ml.link_analysis(.).files_downloaded) > 0
        and 

        // Adobe branding
        ml.link_analysis(.).credphish.brand.name == "Adobe"
        and ml.link_analysis(.).credphish.brand.confidence == "high"
        and 

        // Qakbot text for user coercion
        any(file.explode(ml.link_analysis(.).screenshot),
            all(["the file is not displayed correctly", "document password"],
                strings.icontains(..scan.ocr.raw, .)
            )
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)