A zip attachment contains a img with an exe: the malware. The other, a pdf downloading a zip with an exe: the same malware. The data is exfiltrated via SMTP.
Syria, Russia-Turkey patrols in Idlib blocked by population and militias

Russia and Turkey facing difficulties in Idlib by the local population and militias. Civilians organize blockades on the M4 and rebels threaten attacks
The population of Idlib and rebel militias declare “war” on joint Russia-Turkey patrols on the M4. In the past few hours, local inhabitants have organized blocks and set fire to tires on the highway that from Saraqeb (Aleppo) leads to Latakia. It, according to the recently signed truce, was to be traveled by the convoys of Moscow and Ankara between Trumba and Ain al-Havr. This forced the two countries to reduce the area to be monitored, stopping in Bab al-Hawa for “security reasons”. According to experts, however, sit-ins and protests will not stop. In fact, rebel militias, fighting against the army of Damascus (SAA), lined up with the local inhabitants in the province. From Jabhat Ansar al-Din to Ansar al Tawheed, passing through Jabhat Ansar al-Islam. They threatened to attack patrols if they enter their “territory”.
Ankara, although authorized by Moscow to defeat local groups, has its hands tied. Attacking them would cause collateral damage and Spring Shield cannot be reactivated, as the enemy is not Damascus. Mediation is attempted through parallel diplomacy
Russia “authorized” Turkey to eliminate the terrorist groups. This to ensure a security corridor in the buffer zone on M4. Ankara, however, has a problem: the population supports them, providing them with logistical support and protecting them. As a result, attacking the militiamen could prove to be very dangerous, as there is a risk of collateral damage. Furthermore, the groups have recently rearmed themselves and respond less and less to the direction of the neighboring country, which up to now had used them as a “proxy”. In addition, their activities cannot justify a possible reactivation of the Spring Shield operation, as they are not SAA allied forces. As a result, at least for the time being, the path of parallel diplomacy has been chosen to unlock the situation: Russian and Turkish emissaries are trying to deal with the tribal leaders, promising in exchange a lightening of Damascus pressing on Idlib.