Re: password protected PDF

On 12/18/24 1:09 PM, Kirill A. Korinsky wrote:
> On Wed, 18 Dec 2024 11:01:06 +0100,
> [email protected] wrote:
>>
>> On 12/17/24 8:47 PM, Alex wrote:
>>> Hi,
>>>
>>> It's been a while since I've seen a password-protected zip or PDF, but I got one today that wasn't tagged and was hoping someone might have some ideas.
>>> https://pastebin.com/msPCQHyD <https://pastebin.com/msPCQHyD>
>>>
>>> I've created some basic body and attachment rules, but would be interested in hearing thoughts (either directly or using the above to improve your own rules) from others about how to block them.
>>>
>>> At the least, it should have been identified by clamav.
>>>
>> That email hits SEM_FRESH and GMD_PDF_ENCRYPTED (this needs Mail::SpamAssassin::Plugin::PDFInfo), it seems a good start for a meta rule.
>>   Giovanni
> 
> But SEM_FRESH is commented in the sources...
> 
it has hit SEM_FRESH30 on the user's server (see mail headers).
  Giovanni

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEqg3TnG6R3qYMxl94+r7qCYlyWOUFAmdi2NcFAwAAAAAACgkQ+r7qCYlyWOXg
JA//d1uLfk2+U4S5F2gz8pgeY7jJGcB6y/5FFJMtnUzMiWsspnciXJY8hsKgiUuJqS/xyEiaCesg
GcrIyeysWMdGYGJUu86Rq/yWIU98pti1prZlQZmHzm1UDamLjwcVaB4meJFpeGY7WXFqDNHMaoZP
lJfwh7/9jRMk0Kd2a+RPBP8EcbEQBZt6Ma48PQH0xjqKzo802Pwbd9gVDvyFskMIvs3mPYt9neK3
9NmEONPmrpxkOnGNmXoO55rFBqW8kyY6InK6J3Vb+yLNHS/K2l7abFDrEuZrPD8hRQK20NWy541P
QP3frMUiDt/2CRGbt30GTuIGV/A3NJ36STHoCodU9FSIqgJbqM3y9KUhola++Sg7GLdLQjCYbnG1
mkV+8NAUw/v0Fe7P++UDdmQiQPyQBqYXXahmOvLzINnPvvQ2OCe92yPmCLImsIn9YYlrmJSipHwH
dqfDjDFYwc8xzTVNwl9Qj29J9eUd+WDZNJnVYPCz7kCDXdFErVUggPNfed1HbNSHgZxRFO2t176O
JwdMwkZNnypFvtcTMr0P15/CpPSsqC81yZMiQ6BpMfBE0D8EfU63mQZYSVB3mLAk2VSiFJayl/7+
hNjc2FWrsoVt5NwgEtzuONZxuSYzgKrYqw3whuGybxCTMOZ63fvKyu8cTv3M/wrmmUS5dqyJ2AKX
rbk=
=VLFZ
-----END PGP SIGNATURE-----