John Schmerold skrev den 2015-09-08 23:26:
01/01/1980 12:00 AM 33,280 vbaProject.bin
i would run "strings vbaProject.bin" and make clamav signature based on
it
if you then are happy with amavisd-new this clamav signatures can be
mapped from virus to spam score in amavisd
but possible it would need to be more clever in clamav logical sigs :=)
for spamassassin check spf dkim dmarc, if its pass on it, then score
sender possitive
with possible meta on body content "you need to read resume or
attachment"
i just bet that we dont see any resume now
