← All detection heuristics · Polyglot
critical
JPEG_CARRIER_EMBEDDED_ENCODED_PE
What it means
A valid JPEG carries a loader-delimited encoded Windows executable after the JPEG end marker.
Why it fires
The JPEG itself does not exploit an image viewer. Instead, a separate loader reads the rendered lure image as a carrier, locates a marker such as INICIO after the JPEG EOI marker, decodes the hidden MZ/PE payload, and writes or reflectively runs it. Benign JPEG encoders do not append large loader-marked executable payloads after the logical image end.
Other Polyglot heuristics
IMAGE_TRAILING_OVERLAY_EXECUTABLE POLYGLOT_CHILD_PDF_STATIC_TRIAGE