block exe in pdf-files?

[Dino Edwards]

Have you tried the following in your file rule?

[qr'.\.(docm)$'ix => 1],
[qr'.\.(dotm)$'ix => 1],
[qr'.\.(xlsm)$'ix => 1],
[qr'.\.(xltm)$'ix => 1]

The above SHOULD Block macro enabled office docs. 


-----Original Message-----
From: amavis-users [mailto:amavis-users-bounces+dino.edwards=mydirectmail.net at amavis.org] On Behalf Of Daniel Rieken
Sent: Tuesday, May 30, 2017 9:02 AM
To: amavis-users at amavis.org
Subject: block exe in pdf-files?

Hello,

is it possible to block exe- or docm/xlsm/pptm-files inside of PDF-files?

The new Jaff ransomware is sending a PDF-file with a docm inside this PDF. So I would like to be able to block this emails with amavisd-new...


Cheers!
Daniel