A zip attachment contains a img with an exe: the malware. The other, a pdf downloading a zip with an exe: the same malware. The data is exfiltrated via SMTP.
Syria, Iran seeks to extend its influence in Hasaka

Iran seeks to extend its influence in Hasaka. A recruitment center, aimed primarily at young people, opened in the Syrian city. Tehran is trying to adopt the same tactic in Kurdistan used in Deir Ezzor to hide weapons depots
Iran seeks to extend its influence in Syria, also targeting Kurdish-majority areas. Allied militias have opened a recruiting office in the city of Hasaka where they offer wages of $200 a month for those who enlist in their ranks. The offer is aimed in particular at children. The move is suspected to be an attempt to use local youths to hide and guard weapons caches in an area such as Kurdistan, hitherto considered less endangered by Israel and therefore less policed as a result. It would be the same ploy, used unsuccessfully by the Islamic Republic in the Deir Ezzor quadrant under the control of Damascus. In that case there had also been purchases of various properties through the use of wooden heads, but the intelligence of the Jewish country still managed to identify the deposits hidden in civilian buildings and destroy them.