The fake pdf attached to the "PURCHASE ORDER 05-30-2023" email contains a link, from which you download a tgz file with a TAR, inside which there is an exe: the malware.
Syria, pro-Turkey militias go hunting for artifacts in Hasaka

Pro-Turkey militias hunt for archaeological finds in Hasaka. The excuse is the SDF tunnels search. In reality, they aim to resell them on the black market to finance themselves after Ankara’s aid cut
Pro-Turkey militias north of Hasaka have begun intense excavation at the archaeological sites in the area. Objective: to find artifacts and sell them on the black market to finance themselves, making up for the cut in aid by Ankara. According to local sources, activities are taking place mainly in Tel al-Jihash, near Ras al-Ain (Sere Kanye). It seems that elements of the al-Hamza Division and the Sultan Murad Division are involved. They for about a month have scattered in the quadrant of the Syrian province to hunt down antiquities, particularly near the tombs of the Yazidis. This is because the ethnic group traditionally burns their dead, then burying them together with their most precious possessions. The excuse for the excavations is the search for the SDF tunnels.