The fake pdf attached to the "PURCHASE ORDER 05-30-2023" email contains a link, from which you download a tgz file with a TAR, inside which there is an exe: the malware.
Syria, the SDF may have thwarted an Isis attack on Conoco

The SDF may have foiled an ISIS attack on Conoco. Several IS jihadists arrested between Hasaka and Deir Ezzor in the last few hours, also near the plants
The SDF thwarted a probable Isis attack on the Conoco oil fields in Deir Ezzor. Kurdish special forces on Saturday arrested four members of two IS cells south of Hasaka, including an emir expert in the manufacture of IED bombs. Then, yesterday, they captured four other members of the group: two in Al-Inaad and the same number operating near the facility. In the raid, weapons, ammunition and technical equipment of the jihadists were seized and sent to intelligence experts for analysis. Some elements of the operation such as the scarcity of information provided after the arrests, the very short time window between one raid and another, as well as the type of units used, suggest that these are delicate maneuvers that may not yet have been completed. Analysts speculate that the terrorists were planning an attack and that SDF and Inherent Resolve intervened in the Syrian province, before this was carried out.
Meanwhile, in the north there is a boom in escapes to Turkey. But only from Aleppo. The routes from Idlib and Kurdistan are sealed. A cross-border trip costs between $ 600 and $ 2,800
Meanwhile, some information has arrived on the sudden increase in the flow of civilians who try to flee to Turkey from the north of Syria. In particular from Aleppo. Among them, however, there are also several local or foreign Isis jihadists. Some move independently, paying border guards around $ 1,600 to drive through Hawar Kilis. Others try to walk, but in most cases they are discovered and blocked. IS militiamen and several local inhabitants, on the other hand, rely on expert smugglers for a cost of between 600 and 2,800 dollars. This varies depending on the route to be traveled and the difficulty of the operation, also based on the identity of the person being transported. The only remaining open routes, in fact, cross the areas involved in the Euphrates Shield operation. Those in Idlib were blocked by Hayat Tahrir al-Sham (HTS) and in the east by the Ankara military itself.