The fake pdf attached to the "PURCHASE ORDER 05-30-2023" email contains a link, from which you download a tgz file with a TAR, inside which there is an exe: the malware.
Syria, the SAA in Idlib adopts the Ain Issa militia technique: infiltrate

After the militias in Ain Issa, the Syrian army (SAA) in Idlib also adopts the tactic of infiltrating enemy territory. In the last few hours, the jihadists have foiled attempts in Afes and Jabal Turkman
After the pro-Turkey militias, the Syrian army (SAA) is also trying to infiltrate enemy territory. A group of soldiers tried to break into rebel lines in the Afes area of Idlib, but were pushed back. A similar operation, however, had just been thwarted by the jihadists of Hayat Tahrir al-Sham (HTS) north of Latakia on the Jabal Turkman front. Previously, however, local paramilitary forces, allied with Ankara, had tried several times to isolate Ain Issa, closing the section of the M4 between Hasaka and Aleppo. In the past few hours, in fact, there had been a surprise attack on the front lines of Sayda and Ma’alaq, thwarted by the SDF. Furthermore, groups of jihadists had tried in vain to infiltrate Al-Musharifa, a city considered strategic.
Damascus must break the deadlock around Barah, anticipating Turkey
The Syrian army in Idlib is adopting the same technique as the militias to prepare the ground for the imminent maxi offensive on Barah. The continuous Russian raids and the SAA bombing with artillery on Zawiya, in fact, are sufficient only to prevent the jihadists from launching attacks and strengthening the defenses. They do not, however, allow troops on the ground to advance in force. For this to be possible, someone needs to operate from the inside, hitting the enemy from behind and then forcing them to turn north towards the M4. Times, however, are tight. This is because Turkey is progressively closing the main access routes to the city with new observation points. The latest was set up just a few days ago in Kadoura, very close to the front line of the military in Damascus.