Detects inbound messages containing a PDF attachment whose contents match a YARA signature identifying an MD5 hash appended near the end of file. This technique is commonly used to make each generated PDF unique, helping evade hash-based detection systems. The rule triggers when an inbound message has an attachment with file_type "pdf", expands the file contents (file.explode), and checks for a YARA match with the rule name 'pdf_eof_md5_hash'. By leveraging a YARA signature targeting the PDF structure and the EOF region, it flags attempts to evade static hash-based defenses typically employed by mail gateways and sandboxes. The rule is categorized as high severity, aligned with Credential Phishing and Malware/Ransomware scenarios, and relies on file analysis and YARA-based detection to identify the evasion pattern.