This plugin was introduced in Spamassassin 3.4.1.
This plugin helps detect spam using attached PDF files.
It inspects the PDF attachments for characteristics typical of spam, such as the dimensions of images inside the PDF, the software that produced it, whether the PDF is encrypted, and whether the message body is empty, using eval functions such as pdf_count(), pdf_image_count(), pdf_pixel_coverage(), pdf_match_details(), pdf_is_encrypted(), and pdf_is_empty_body().
The PDFInfo plugin adds the following tags that are available for use in reports, header fields, and other plugins:
| Tag | Description |
|---|---|
_PDFCOUNT_ |
total number of pdf mime parts in the email |
_PDFIMGCOUNT_ |
total number of images found inside pdf mime parts |
_PDFVERSION_ |
PDF Version, space separated if there are > 1 pdf attachments |
_PDFNAME_ |
Filenames as found in the mime headers of PDF parts |
_PDFPRODUCER_ |
Producer/Application that created the PDF(s) |
_PDFAUTHOR_ |
Author of the PDF |
_PDFCREATOR_ |
Creator/Program that created the PDF(s) |
_PDFTITLE_ |
Title of the PDF File, if available |
_PDFIMGDIM_ |
If PDF Contains images, the dimensions of them will be put here |
_PDFIMGAREA_ |
The total area of all combined images inside the PDF(s) |
_PDFMD5_ |
MD5 checksum of PDF(s) - space separated |
_PDFMD5FUZZY1_ |
Fuzzy1 MD5 checksum of PDF(s) - space separated |
_PDFMD5FUZZY2_ |
Fuzzy2 MD5 checksum of PDF(s) - space separated |
| Area | Rule name | Description | Default scores |
|---|---|---|---|
| body | GMD_PDF_HORIZ |
Contains pdf 100-240 (high) x 450-800 (wide) | 0.25 |
| body | GMD_PDF_SQUARE |
Contains pdf 180-360 (high) x 180-360 (wide) | 0.50 |
| body | GMD_PDF_VERT |
Contains pdf 450-800 (high) x 100-240 (wide) | 0.90 |
| body | GMD_PRODUCER_GPL |
PDF producer was GPL Ghostscript | 0.25 |
| body | GMD_PRODUCER_POWERPDF |
PDF producer was PowerPDF | 0.25 |
| body | GMD_PRODUCER_EASYPDF |
PDF producer was BCL easyPDF | 0.25 |
| body | GMD_PDF_ENCRYPTED |
Attached PDF is encrypted | 0.60 |
| body | GMD_PDF_EMPTY_BODY |
Attached PDF with empty message body | 0.25 |
This plugin has no additional settings. It can be enabled or disabled under Warden -> Settings -> Plugin Settings -> PDFInfo.