My mailserver just quarantined a legit email with an attached pdf that 
matched the below procmail rules:

:0 B
* ^(UEsDBAoAAAAAA)
/spool/mail.quarantine/.

:0 B
* ^(UEsDBAoAA)
/spool/mail.quarantine/.

Here are lines grep'd out of the attachment, the string(s) appears 
several times:

hxQeZJ9j3wwcODPwP7pKuPvQu/HbAAAAAElFTkSuQmCCUEsDBAoAAAAAAAAAIQAS0co8siEAALIh
UEsDBAoAAAAAAAAAIQCaKHUY0gYAANIGAAAWAAAAd29yZC9tZWRpYS9pbWFnZTI2LnBuZ4lQTkcN
DvrNpygOxIEB6MB/AeIm1Hb+D6u+AAAAAElFTkSuQmCCUEsDBAoAAAAAAAAAIQAs1cAQs3kAALN5
QmCCUEsDBAoAAAAAAAAAIQAD4JZzPxQAAD8UAAAWAAAAd29yZC9tZWRpYS9pbWFnZTQyLnBuZ4lQ
LkoKB8KBcCAcCAfCgXAgHAgHwoFwIBwIB8KBlh34CwzG7V8nHCM/AAAAAElFTkSuQmCCUEsDBAoA

I am going to scan the stuffing out of the pdf tomorrow, but am 
wondering if these strings are still valid for catching malicious 
emails?  I inherited these rules and research on them looks antiquated. 
  They are redundant in security terms as the vast majority of mail 
sanitizing is done on other dedicated systems.

Thanks and apologies for cross-postings,
-Charles