Polyglot detection heuristics

Executable/encoded overlay appended after image end critical IMAGE_TRAILING_OVERLAY_EXECUTABLE

A valid image is followed by a large appended overlay that is a second container (PE/ZIP/...) or a loader-delimited base64-encoded payload.

JPEG carrier with embedded encoded executable payload critical JPEG_CARRIER_EMBEDDED_ENCODED_PE

A valid JPEG carries a loader-delimited encoded Windows executable after the JPEG end marker.

Polyglot Child PDF Static Triage high POLYGLOT_CHILD_PDF_STATIC_TRIAGE

Polyglot child-content evidence: Polyglot Child PDF Static Triage.