Link to auto-download of a suspicious file type (unsolicited)

type.inbound
and any(body.links,
        // Detect suspicious direct Google Drive downloads
        (
          strings.icontains(.href_url.url, "drive.google.com/uc")
          and strings.icontains(.href_url.url, "export=download")
          and any(ml.link_analysis(., mode="aggressive").files_downloaded,
                  .file_extension in $file_extensions_common_archives
          )
        )
        or any(ml.link_analysis(.).files_downloaded,
               // call parse_exif to see if there is a sus file
               any(beta.parse_exif(.).fields,
                   .key == "ArchivedFileName"
                   and strings.ilike(.value,
                                     "*.dll",
                                     "*.html",
                                     "*.exe",
                                     "*.lnk",
                                     "*.js",
                                     "*.vba",
                                     "*.vbs",
                                     "*.vbe",
                                     "*.bat"
                   )
               )
               or any(file.explode(.),
                      (
                        // look for files in encrypted zips.
                        // if password cracking the zip wasn't
                        // successful, our only opportunity to look
                        // for suspicious file types is here under
                        // .zip.attempted_files
                        "encrypted_zip" in .flavors.yara
                        and any(.scan.zip.attempted_files,
                                strings.ilike(.,
                                              "*.dll",
                                              "*.html",
                                              "*.exe",
                                              "*.lnk",
                                              "*.js",
                                              "*.vba",
                                              "*.vbs",
                                              "*.vbe",
                                              "*.bat"
                                )
                        )
                      )
                      // for both non-encrypted zips and encrypted zips
                      // that were successfully cracked
                      or .file_extension in (
                        "dll",
                        "exe",
                        "html",
                        "lnk",
                        "js",
                        "vba",
                        "vbs",
                        "vbe",
                        "bat"
                      )
                      or strings.ilike(.file_name, "*.exe")
                      or (
                        .file_extension not in ("dll", "exe")
                        and (
                          .flavors.mime in ("application/x-dosexec")
                          or any(.flavors.yara, . in ('mz_file'))
                        )
                      )
                      or any(.flavors.yara, . == "macho_file")
               )
               and not (
                 ml.link_analysis(..).effective_url.domain.root_domain == "zoom.us"
                 and .file_extension == "exe"
               )
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)