Hidden ZIP with executable payloads in PDF stream

PDFs can legitimately carry attachments, but normal attachments are declared through /EmbeddedFile, /EmbeddedFiles, or /EF metadata so the viewer and user can treat them as attachments. The detector looks for the different pattern of raw ZIP local-file headers hidden inside ordinary PDF stream bytes, then only fires when ZIP entry names end in executable payload extensions such as .dll, .exe, .scr, .ps1, .hta, or .lnk. Legitimate reasons for DLLs inside a PDF are very rare; a software manual or PDF portfolio should use explicit attachment metadata, not a concealed stream archive.