Malicious JPEG uses reversed BASE64 encoding
SANS ISC handler demonstrates reversing a custom BASE64 encoding scheme in a malicious JPEG file that hides a Windows PE payload using character substitution and string reversal.
SANS ISC senior handler Didier Stevens analyzed a malicious JPEG file containing embedded Windows executable code disguised through custom BASE64 encoding. The analysis built upon Xavier Mertens' earlier work identifying the "Evil MSI Background" campaign. Using byte-stats.py and base64dump.py tools, Stevens identified that nearly half the file content (45.65%) consisted of BASE64 characters, with the longest encoded string approaching 1 million characters.
The payload employed two layers of obfuscation: first, the letter 'A' in standard BASE64 was replaced with the '#' character; second, the entire encoded string was reversed, placing the padding characters '==' at the beginning rather than the end. The reversed string ended with '...qVT' which, when reversed to 'TVq', revealed the 'MZ' header marker of a Windows PE executable.
This research demonstrates advanced evasion techniques used to embed malicious executables in image files. Stevens enhanced his base64dump.py tool with a new --stats option that provides character frequency analysis to aid in identifying custom encoding schemes. The extracted payload matched the hash of the file previously analyzed by Xavier Mertens, confirming the presence of the malicious executable.
Mentioned in this report
Detection guidance
Suspicious PowerShell Extraction of Embedded Payload from Image File
Detects PowerShell command lines that read an image file and pipe its content through Base64 decoding functions, consistent with extracting an embedded executable hidden in a JPEG/PNG. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious PowerShell Extraction of Embedded Payload from Image File
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \\powershell.exe
- \\pwsh.exe
selection_read:
CommandLine|contains:
- .jpg
- .jpeg
- .png
- .bmp
selection_decode:
CommandLine|contains:
- FromBase64String
- -join
- 'Convert]::'
- Get-Content -Raw
filter_common:
CommandLine|contains:
- Resize-Image
- Get-ItemProperty
condition: selection_img and selection_read and selection_decode and not filter_common
falsepositives:
- Legitimate image-processing or automation scripts that combine image files and Base64
operations for benign encoding tasks
- Developer/debugging scripts that manipulate image byte arrays
level: high
tags:
- attack.t1027.009
- attack.t1140
- attack.defense_evasion
id: e2f3171d-90e8-563a-8757-55756434dfcc
status: experimental
author: Vorant
Certutil or Similar Utility Decoding Payload from Image File
Detects use of certutil.exe or similar built-in decoding utilities against files with image extensions, a pattern consistent with extracting a Base64-encoded executable embedded in a picture file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Certutil Decode Operation Targeting Image File
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- \\certutil.exe
selection_decode_flag:
CommandLine|contains:
- -decode
- /decode
selection_image_ext:
CommandLine|contains:
- .jpg
- .jpeg
- .png
- .bmp
- .gif
condition: selection_tool and selection_decode_flag and selection_image_ext
falsepositives:
- Rare legitimate administrative use of certutil to decode certificate files that
happen to be misnamed with image extensions
level: high
tags:
- attack.t1140
- attack.t1027
- attack.defense_evasion
id: 9d8ffdf2-5b32-5b79-a207-c265494757f1
status: experimental
author: Vorant
Executable File Written Immediately After Reading Image File Content
Detects a script interpreter or utility process creating a new PE (.exe/.dll) file shortly after opening or reading an image file, suggesting extraction of an embedded payload disguised via custom Base64 encoding inside a picture. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PE File Creation Following Image File Access By Scripting Host
logsource:
category: file_event
product: windows
detection:
selection_creator:
Image|endswith:
- \\powershell.exe
- \\pwsh.exe
- \\python.exe
- \\cscript.exe
- \\wscript.exe
selection_target:
TargetFilename|endswith:
- .exe
- .dll
filter_installers:
TargetFilename|contains:
- \\Windows\\Temp\\
- \\AppData\\Local\\Temp\\NuGet
condition: selection_creator and selection_target and not filter_installers
falsepositives:
- Legitimate build scripts or installers that use scripting hosts to write executables
to disk
- Software update mechanisms that unpack executables from downloaded resource files
level: medium
tags:
- attack.t1027
- attack.t1027.009
- attack.defense_evasion
id: bd371996-139e-5cfa-8ee3-83ff0e02ea26
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33072
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free