The fake pdf attached to the "PURCHASE ORDER 05-30-2023" email contains a link, from which you download a tgz file with a TAR, inside which there is an exe: the malware.
Syria: after Russia-Turkey agreement, Isis revenge on the Kurds begins

Isis in a single day launched at least four attacks against the SDF: from Qamishlo to Suluk, passing through Shaddadi and the road to Raqqa
Isis, taking advantage of the Turkish offensive in northern Syria, increases attacks on SDF in the quadrant. A few hours ago in Qamishlo, the epicenter of the Kurdish administration in the region, a car bomb exploded which fortunately did not cause victims. However, this is the revenge of the Islamic State against the local population and institutions. Not surprisingly, in fact, the city is not part of the territory co-managed by Turkey and Russia, established with the agreement just signed. About an hour and a half later there was another explosion, this time at Suluk. The area is predominantly Arab and is located south east of Gire Spi (Tal Abyad). But, unlike Qamishlo, it falls within the agreement between Moscow and Ankara. Finally, a third explosion was recorded in Shaddadi, south of Hasaka, in the middle of Kurdish territory. There are still no official claims, but in all probability the hand is Daesh.
In the north-east of Syria the revenge of the Islamic State on the Kurds began. New attacks are feared soon. In the south, instead, Jazeera Storm kept pressing on Daesh
ISIS finally announced on its Telegram channels that it had attacked an SDF convoy on the road between Shaddadi and Raqqa. So far, however, the militants of the Islamic State have never ventured into making more blitzes simultaneously, in different areas in the north east of Syria. This is further confirmation that Daesh has benefited from the Turkish offensive. Not only because it has been seen as easing the pressure from the Kurdish forces. But also because it was possible to reorganize, taking advantage of the enemy’s distraction, “betrayed by the Crusaders” as reported last Thursday by the propaganda magazine al-Naba. Therefore, new attacks are expected soon. Especially along the border of the buffer zone. In the south of the region, however, the situation is different. On one side there are still American soldiers and on the other, Jazeera Storm has never stopped pressing on jihadists.