Attachment: HTML Smuggling of Zip File with Evasion Indicators (Unsolicited)

type.inbound

and (
    (
        not profile.by_sender_email().solicited
        and profile.by_sender_email().prevalence in ("new", "outlier")
    )
    or (
        profile.by_sender_email().any_messages_malicious_or_spam
        and not profile.by_sender_email().any_false_positives
    )
    or sender.email.domain.domain == "delivrto.me"
)

and any(attachments,
    // HTML file format
    (
        regex.imatch(.file_extension, '^[sdx]{0,1}ht[ml]{0,2}') or 
        .file_type == "html"
    )
    and any(file.explode(.),
        any(.flavors.yara, . == "javascript_file") and 
        
        // High entropy JavaScript
        .scan.entropy.entropy > 5 and 
        
        // Array manipulation and evasion indicators
        all(["push", "shift", "atob"], . in ..scan.javascript.strings) and 

        // Smuggling Indicators
        all(["octet/stream", "revokeObjectURL", "appendChild", "URL", "click"], . in~ ..scan.javascript.strings) and

        // ZIP B64 File Header
        any(.scan.javascript.strings, strings.istarts_with(., "UEsDBB"))
    )
)