← All detection heuristics · HTML
high
HTML_SMUGGLED_PAYLOAD
What it means
A contiguous or constant-concatenated base64 value inside an inline script decodes to a complete archive, executable, document or HTA.
Why it fires
The blob is decoded and accepted only on self-validating evidence: container/executable magic bytes (ZIP, PE, PDF, OLE, RAR, 7z) or an explicit <hta:application> declaration. Inline images, fonts, minified bundles and HTML templates do not fire. This is the HTML-smuggling delivery pattern: the payload never crosses the network as a file, so gateway and proxy scanning never inspects it, and the page reassembles it in the browser. The decoded payload is carved as an artifact so ClamAV and static triage can examine it.
Other HTML heuristics
HTML_HTA_VBSCRIPT_DOM_EXECUTE HTML_THIRD_PARTY_CREDENTIAL_HARVEST HTML_ACTIVEX_OBJECT HTML_WINDOWS_SCRIPTING_OBJECT HTML_VBSCRIPT HTML_CREDENTIAL_PHISH_DYNDNS HTML_SCRIPTED_COM_EXECUTION HTML_XOR_BASE64_EVAL_INJECTION HTML_LONG_BASE64_SCRIPT_PAYLOAD HTML_OBFUSCATED_STRING_BUILDER HTML_AD_FRAUD_CLOAKING HTML_BASE64_PAYLOAD_URL