I made a rules based validation for this kind of an issue for .pdf extensions
The Expression (contains(substring(., 33, 300), "AuAHAAZABm") =False and contains(substring(., 33, 300), "LgBwAGQAZg")= False and contains(substring(., 33, 300), "AC4AcABkAGY")=False )
There are more details on my LinkedIn post for ...