← All detection heuristics · Generic
critical
DECODED_EMBEDDED_PAYLOAD
What it means
Decoded content contains a valid executable or risky archive.
Why it fires
Only structurally valid PE headers or ZIP archives with executable/script members qualify. Incidental magic bytes and Office-only theme packages are excluded.