Problem

ClamAv is classifying emails with PDF attachments as SPAM for no reason, as logs report:

./clamd.log

stream(127.0.0.1@1681): Heuristics.Encrypted.PDF FOUND
stream(127.0.0.1@2020): Heuristics.Encrypted.PDF FOUND
stream(127.0.0.1@1492): PUA.OLE.EmbeddedPDF FOUND

Solution

The solution provided by the website virustotal.com is to tell ClamAV to skip the a PUA filter, in this case adding to the clam configuration file the following lines:

./clamd.conf

DetectPUA yes
ExcludePUA OLE.EmbeddedPDF
ArchiveBlockEncrypted no

Dont forget to restart the ClamAV service / daemon to load the new configuration.

Usefull Links

Virustotal link: https://www.virustotal.com/