This rule detects inbound PDF attachments that contain base64-encoded JavaScript variables and use eval() for dynamic execution, signaling potential code obfuscation and runtime payload loading. It relies on a YARA signature named pdf_b64_js_var_eval and targets first-level contents of the attachment (depth 0) after exploding the file structure. The combination of file analysis (to identify PDFs), JavaScript analysis (to inspect embedded scripts), and YARA matching indicates an evasion-focused technique commonly observed in malicious documents aiming to execute code or deploy a payload when opened. The rule is categorized under Malware/Ransomware with a focus on PDF-based evasion techniques. Typical indicators include obfuscated JavaScript stored in base64 form and invoked via eval, which enables silent or difficult-to-detect execution paths within a PDF reader environment. Mitigations include inspecting and potentially quarantining such attachments, applying sandboxing or conditional access for PDFs with embedded JavaScript, and enforcing stricter controls on executable content within documents. Note that legitimate use cases with embedded JS in PDFs are possible but uncommon, and baselining such activity helps reduce false positives while maintaining focus on high-risk doc delivery. Potential follow-ons involve automated isolation, user alerts, and correlation with other indicators of compromise to validate legitimacy.