Spam: Unsolicited malformed PDF

type.inbound
// body text is very short
and length(body.current_thread.text) < 50

// one attachment
and length(attachments) == 1

// attachment is named a pdf, but mime type doesn't match with high entropy
and any(attachments,
        .file_type == "unknown"
        and strings.ends_with(.file_name, "pdf")
        and any(file.explode(.),
                .flavors.mime in (
                  "application/octet-stream",
                  "application/marc"
                )
                and .scan.entropy.entropy >= 6
        )
)
// a free email address was hyperlinked 
and any(body.links,
        .display_text is null and .href_url.url in $free_email_providers
)

// multiple freemail senders found in recipients.to
and length(filter(recipients.to,
                  .email.domain.root_domain in $free_email_providers
           )
) >= 3

// unsolicited and no false positives or previously flagged
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign