PDF attachment with Google (AE) redirecting to a php or zip file

type.inbound
and any(attachments,
        .file_type == "pdf"
        and any(file.explode(.),
                any(.scan.pdf.urls,
                    // url encoded q=http
                    strings.starts_with(.query_params, "q=%68%74%74%70")
                    // url encoded .php or .zip
                    and (
                      strings.contains(.query_params, ".%70%68%70")
                      or strings.contains(.query_params, "%2e%7a%69%70")
                    )
                    and .domain.root_domain == "google.ae"
                )
        )
)