At 12:49 05-07-2007, Chip M. wrote:
>Here's a new style of PDF spam (recipient email address is munged):


[snip]

> - uses "application/octet-stream" instead of "application/pdf"
> as the Content-Type


From your sample:

Content-Type: application/octet-stream; name="Message.pdf"

You could match on the "application/octet-steam" and the file
extension being ".pdf".

Regards,
-sm