A zip attachment contains a img with an exe: the malware. The other, a pdf downloading a zip with an exe: the same malware. The data is exfiltrated via SMTP.
Syria, militias are flowing in Turkish posts south of Idlib

Pro-Turkey militias begin to flow on the M4 south of Idlib, towards Jisr al-Shughour. Objectives: to prevent possible SAA offensives and prepare maneuvers against Kurdistan
Pro-Turkey militias are flowing on the M4 south of Idlib, in anticipation of an offensive against Syrian Kurdistan. In the past few hours, numerous members of the National Liberation Front (LNF) have lined up at positions created by the TAF in recent days on the Aleppo-Latakia highway. In particular, these are located near Al-Kufayr, Bdama, Al-Zi’ayniyyah and Ain Hour. The objective is twofold: on the one hand, to prevent the Damascus army (SAA) from using the road section to launch a ground offensive against allied groups in the province. On the other hand, it is creating a strong “base” from which to start the maneuvers in the East. Not surprisingly, the pro-Ankara militias continue their attempts to infiltrate Ain Issa to take control of the communication route and “cut” possible forms of external support, while at the same time allowing the “partners” to reach the front line directly and quickly.
The formal excuse is to improve security conditions along the highway in the Syrian province, so that joint TAF-Russian patrols resume
Last week, according to a report by the Syrian Observatory for Human Rights (SOHR), Turkish forces placed prefab positions in several areas of the M4 south of Idlib and west of Jisr al-Shughour. The formal excuse was to create the necessary security conditions so that joint Russian-TAF military patrols along the highway can resume. They have been interrupted last August following several attacks by local jihadist groups. In reality, however, once the structures were completed, the arrival of the militias began to be detected. They occupied the buildings and lined up en masse. Moreover, the flow of fighters goes hand in hand with that of Turkish soldiers, who enter the Syrian province from the Kafr Loosin crossing and head to Zawiya. The aim here is to prevent any SAA offensive on Barah.