A zip attachment contains a img with an exe: the malware. The other, a pdf downloading a zip with an exe: the same malware. The data is exfiltrated via SMTP.
Syria: ISIS, Damascus and Turkey try to hit SDF and Kurds in the East

ISIS seeks revenge on the SDF and the population in eastern Syria. Bomb attacks by the Islamic State in Raqqa, Deir Ezzor and Hasaka are on the rise
Isis seeks revenge against the SDF and the population in the east of Syria. In recent days the militants of the Islamic State have carried out several attacks in the provinces of Raqqa, Deir Ezzor and Hasaka. In all cases vehicles filled with explosives were used. It is Daesh’s response to the Jazeera Storm operation going on across the quadrant to eliminate the fundamentalist cells, which infiltrate the region via the Euphrates. One of the last, large, was dismantled last week in the former IS capital of the Middle Eastern country. This was responsible for many of the attacks in the city. Other smaller groups, on the other hand, were intercepted in the villages along the Shaddadi Road. Here, especially in Busayrah, Shahil and Dhiban, there is the greatest flow of terrorists from the desert of Badia al-Sham. It is no coincidence that the Arab-Kurdish forces must return periodically to stop the new threats.
In Hasaka, however, there are also pro-Damascus and Turkey groups that attack Jazeera Storm and the civilians, blaming Daesh. Objective: to feed the insecurity to harm the Kurds and favor the return to the Syrian army (SAA) in the area
The SDF, however, beyond ISIS must also oppose another threat: that of the groups, sent by Turkey and Damascus to carry out attacks in eastern Syria. The goal is to feed the feeling of insecurity, putting the blame on Daesh, and the distrust of the population against Jazeera Storm. In particular, that of the local Arab component towards the Kurds. This is so that the combatants are weakened and the regime of Bashar Assad and Ankara benefit from it. It is no coincidence that these para-military fighters strike above all in the province of Hasaka, on the border with Turkey. The confirmation came from the arrest of a cell of seven elements, which took place on August 24th. Some members have confessed to having been forced to hit the SDF to favor a possible return of the Syrian army (SAA) in the quadrant.