Attachment: PDF with embedded MHT using ActiveMime objects (Unsolicited)

type.inbound

and any(attachments,
    (
        // PDF is a direct attachment or this is an archive format
        (
            .file_extension == "pdf" and 
            .file_type == "pdf"
        ) or 
        .file_extension in $file_extensions_common_archives
    ) and 
    any(file.explode(.),
        // The file is a PDF but has indicators of MHT with ActiveMime
        .file_extension == "pdf" and 
        any(.scan.strings.strings, strings.ilike(., "*mime*")) and 
        any(.scan.strings.strings, strings.ilike(., "*content-location*")) and 
        any(.scan.strings.strings, strings.ilike(., "*content-type*")) and 
        
        // Specifically a macro definition
        any(.scan.strings.strings, strings.ilike(., "*Edit-Time-Data*")) 
    )
)

and (
  not profile.by_sender_email().solicited
  or sender.email.domain.domain == "delivrto.me"
)