ClamAv is classifying emails with PDF attachments as SPAM for no reason, as logs report:
stream(127.0.0.1@1681): Heuristics.Encrypted.PDF FOUND stream(127.0.0.1@2020): Heuristics.Encrypted.PDF FOUND stream(127.0.0.1@1492): PUA.OLE.EmbeddedPDF FOUND
The solution provided by the website virustotal.com is to tell ClamAV to skip the a PUA filter, in this case adding to the clam configuration file the following lines:
DetectPUA yes ExcludePUA OLE.EmbeddedPDF ArchiveBlockEncrypted no
Dont forget to restart the ClamAV service / daemon to load the new configuration.
Virustotal link: https://www.virustotal.com/