Re: password protected PDF
| Newsgroups | gmane.mail.spam.spamassassin.general |
|---|---|
| Message-ID | <[email protected]> |
On 12/17/24 8:47 PM, Alex wrote: > Hi, > > It's been a while since I've seen a password-protected zip or PDF, but I got one today that wasn't tagged and was hoping someone might have some ideas. > https://pastebin.com/msPCQHyD <https://pastebin.com/msPCQHyD> > > I've created some basic body and attachment rules, but would be interested in hearing thoughts (either directly or using the above to improve your own rules) from others about how to block them. > > At the least, it should have been identified by clamav. > That email hits SEM_FRESH and GMD_PDF_ENCRYPTED (this needs Mail::SpamAssassin::Plugin::PDFInfo), it seems a good start for a meta rule. Giovanni
OpenPGP_signature.asc
(application/pgp-signature, 840 B)
-----BEGIN PGP SIGNATURE----- wsF5BAABCAAjFiEEqg3TnG6R3qYMxl94+r7qCYlyWOUFAmdinWIFAwAAAAAACgkQ+r7qCYlyWOUY IQ//SH0jkU1P48wPk4cMtDK+KG7LbDa4cRtMkoSeWdObR5N+O+2tmMlQDmRD+kIo5tpumTQ8dYrD ohS3vdIOJ/R0THxcOapVLm5w6dKjzO4m3FjTlvO/sRJA+myNdoeVXR3pWR0QRWe9MWdIX86tgbT6 8N6v1HRrU+JgA+bobrBNBx8jZtBxHHLLYEhws2RhtYeeRUOGQOoXRzroakAtF61tcOClpwDYtSJ9 W3JknpoWUZPu9Y+AjjdvousX2vaCOLA+MTPsw2AGXve5nPAIZ6bu6EoqG95312DK3yvlG60nDm8B JdrPevEmEz+rW4AZrqvnh01wa2E3FwieKwJCso3p+RKLicrTNzRJIu4LwHkSSEXTWXzAm1gDhDCh NIaoZVA+UjzTfTJ3RHAPEWruJhOhRpZM05d6JtvvzodGoB4DOX6SYH0Itg1C64OSiIw4pLx0XzSV +zdn8n3MtpZNoIH3hBvZey0qTAtjoNdqwO6qM+7zfQphHT6+QY5g4qcmALWFlMiC2W7cWHRbjOxK c2zsg+QUREgc4sjnb+kdaCc9FuzP+NBXhS7sqYypbWGTVnOVfHtj8fFNWhQp1Uj/ZaH3zNHYE8ba d5TOIMuRkKOk5o5cNsFe6OX4URCc6u+X3RH8qyQINE085e0e+ttnNxt08BEJ1/6uAfvY7ojKEOTk J7c= =qBHz -----END PGP SIGNATURE-----