JPEG carrier with embedded encoded executable payload

JPEG_CARRIER_EMBEDDED_ENCODED_PE

← All detection heuristics · Polyglot

critical JPEG_CARRIER_EMBEDDED_ENCODED_PE

What it means

A valid JPEG carries a loader-delimited encoded Windows executable after the JPEG end marker.

Why it fires

The JPEG itself does not exploit an image viewer. Instead, a separate loader reads the rendered lure image as a carrier, locates a marker such as INICIO after the JPEG EOI marker, decodes the hidden MZ/PE payload, and writes or reflectively runs it. Benign JPEG encoders do not append large loader-marked executable payloads after the logical image end.

Other Polyglot heuristics

IMAGE_TRAILING_OVERLAY_EXECUTABLE POLYGLOT_CHILD_PDF_STATIC_TRIAGE