SA 4.0.x: extracting a phishing URL buried 4 decode layers deep -- in a base64 HTML attachment wrapping a data: URI PDF?

i run

	spamassassin -V
		SpamAssassin version 4.0.2
		running on Perl version 5.42.2

it's invoked as a milter in my postfix setup.

a phish just snuck by ...
once submitted to Bayes and re-scanned, it *is* pushed over threshhold.

i'm looking at why it snuck by in the first place.
there _is_ a phishing URL, deeply embedded; my current setup fails to find/act-on it.

the message structure MIME tree has two parts, nothing suspicious on the surface:

   multipart/related
   |-- text/html
   |-- application/octet-stream   base64, filename=DHL_SHIPPING_LETTER.html

the phishing URL is not obviously in that MIME tree.
it's buried inside that octet-stream attachment -- 4 decode steps deep.
my SA missed it.

manually, i can grab it

	(1) base64-decode the attachment
		--> an HTML document
	(2) read its <embed src="data:...pdf;base64,...">
		--> data: URI
	(3) base64-decode that data: URI
		--> a PDF
	(4) read the PDF's /URI link annotation
		--> the phishing URL

i.e., the phising URL sits four layers down:
	MIME part --> base64 --> HTML --> data: URI --> base64 --> PDF --> /URI annotation.
SA sees only that first, single opaque attachment.
it never performs the four in-payload decodes.

how to config SA 4.0.x to find/exctract that "deep" URL?

iiuc, neither out-of-the-box ExtractText nor OLEVBMacro are sufficient?

is a custom, multi-step ExtractText extractor script needed? e.g., that:
	decodes the octet-stream HTML
	pulls the data:application/pdf;base64 blob
	base64-decodes it
	extracts the PDF /URI annotation
	emits the URLs as actionable plain text
?

or is there something that already exists?

is chained/recursive extraction configurable in ExtractText, or other?

even once you reach the PDF, running pdftotext via ExtractText doesn't appear to emit /URI link annotations.
it can't surface the URL.

i think pdftohtml/mutool could, but pdftohtml emits HTML, which ExtractText documents as unsupported output,

	@ https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Plugin_ExtractText.html
	
		"...
		External tool must output plain text, not HTML or other non-textual result.
		..."