Link to auto-downloaded file with Google Drive branding

type.inbound
and length(body.links) < 10
and any(body.links,
        // This isn't a Google Drive link
        .href_url.domain.root_domain != "google.com"
        and 

        // There are files downloaded
        length(ml.link_analysis(.).files_downloaded) > 0
        and 

        // Google Drive branding
        ml.link_analysis(.).credphish.brand.name == "GoogleDrive"
        and ml.link_analysis(.).credphish.brand.confidence == "high"
        and 

        // Hi from Qakbot
        any(file.explode(ml.link_analysis(.).screenshot),
            any(["the file is not displayed correctly", "use local downloaded file"],
                strings.icontains(..scan.ocr.raw, .)
            )
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)