Suspicious attachment: Duplicate decoy PDF files

type.inbound
and length(attachments) > 1
and all(attachments, .file_type == "pdf")
and (
  length(distinct(attachments, .file_name)) == 1
  or length(distinct(attachments, .md5)) == 1
)
and all(attachments,
        .file_type == "pdf"
        and all(file.explode(.),
                (
                  length(.scan.url.urls) == 0
                  or length(.scan.pdf.urls) == 0
                  or length(body.links) == 0
                )
                and .scan.ocr.raw is null
        )
)