Attachment: PDF with Auto-Open Embedded Smuggling File

type.inbound
and any(attachments, 
    // Attachment is PDF
    .file_extension == "pdf" and 
    
    // PDF contains JavaScript containing indicators of 'AutoOpen' capability.
    any(file.explode(.),
        // Snippet from auto-open PDF:
        // /S /JavaScript
        // /JS (this.exportDataObject({ cName: "file.html", nLaunch: 2 });)
        any(.scan.strings.strings, strings.icontains(.,'/JavaScript')) and 
        any(.scan.strings.strings,strings.icontains(.,'exportDataObject'))
    ) and 
    
    // Within the PDF is a file capable of smuggling, including HTML and SVG formats
    any(file.explode(.),
        // The analysed HTML/SVG file is directly embedded in the PDF, rather than being contained in an archive
        .depth == 1 and 
        (
            regex.imatch(.file_extension, '^([sdx]{0,1}ht[ml]{0,2})$') or
            strings.ilike(.flavors.mime,
                "image/svg+xml",
                "text/html"
            ) or 
            any(.flavors.yara, . == 'html_file')
        )
    )
)
and (
  not profile.by_sender_email().solicited
  or sender.email.domain.domain == "delivrto.me"
)