VORANT. Threat Intelligence Research Create a free account

Malicious JPEG uses reversed BASE64 encoding

Published Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

SANS ISC handler demonstrates reversing a custom BASE64 encoding scheme in a malicious JPEG file that hides a Windows PE payload using character substitution and string reversal.

Sourceisc.sans.edu — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.

SANS ISC senior handler Didier Stevens analyzed a malicious JPEG file containing embedded Windows executable code disguised through custom BASE64 encoding. The analysis built upon Xavier Mertens' earlier work identifying the "Evil MSI Background" campaign. Using byte-stats.py and base64dump.py tools, Stevens identified that nearly half the file content (45.65%) consisted of BASE64 characters, with the longest encoded string approaching 1 million characters.

The payload employed two layers of obfuscation: first, the letter 'A' in standard BASE64 was replaced with the '#' character; second, the entire encoded string was reversed, placing the padding characters '==' at the beginning rather than the end. The reversed string ended with '...qVT' which, when reversed to 'TVq', revealed the 'MZ' header marker of a Windows PE executable.

This research demonstrates advanced evasion techniques used to embed malicious executables in image files. Stevens enhanced his base64dump.py tool with a new --stats option that provides character frequency analysis to aid in identifying custom encoding schemes. The extracted payload matched the hash of the file previously analyzed by Xavier Mertens, confirming the presence of the malicious executable.

Mentioned in this report

Campaigns Evil MSI Background

Related reporting

Detection guidance

Suspicious PowerShell Extraction of Embedded Payload from Image File

ATT&CK T1027.009 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects PowerShell command lines that read an image file and pipe its content through Base64 decoding functions, consistent with extracting an embedded executable hidden in a JPEG/PNG. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious PowerShell Extraction of Embedded Payload from Image File
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \\powershell.exe
    - \\pwsh.exe
  selection_read:
    CommandLine|contains:
    - .jpg
    - .jpeg
    - .png
    - .bmp
  selection_decode:
    CommandLine|contains:
    - FromBase64String
    - -join
    - 'Convert]::'
    - Get-Content -Raw
  filter_common:
    CommandLine|contains:
    - Resize-Image
    - Get-ItemProperty
  condition: selection_img and selection_read and selection_decode and not filter_common
falsepositives:
- Legitimate image-processing or automation scripts that combine image files and Base64
  operations for benign encoding tasks
- Developer/debugging scripts that manipulate image byte arrays
level: high
tags:
- attack.t1027.009
- attack.t1140
- attack.stealth
id: e2f3171d-90e8-563a-8757-55756434dfcc
status: experimental
author: Vorant

Certutil or Similar Utility Decoding Payload from Image File

ATT&CK T1140 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects use of certutil.exe or similar built-in decoding utilities against files with image extensions, a pattern consistent with extracting a Base64-encoded executable embedded in a picture file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Certutil Decode Operation Targeting Image File
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
    - \\certutil.exe
  selection_decode_flag:
    CommandLine|contains:
    - -decode
    - /decode
  selection_image_ext:
    CommandLine|contains:
    - .jpg
    - .jpeg
    - .png
    - .bmp
    - .gif
  condition: selection_tool and selection_decode_flag and selection_image_ext
falsepositives:
- Rare legitimate administrative use of certutil to decode certificate files that
  happen to be misnamed with image extensions
level: high
tags:
- attack.t1140
- attack.t1027
- attack.stealth
id: 9d8ffdf2-5b32-5b79-a207-c265494757f1
status: experimental
author: Vorant

Executable File Written Immediately After Reading Image File Content

ATT&CK T1027 · status experimental · needs windows file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a script interpreter or utility process creating a new PE (.exe/.dll) file shortly after opening or reading an image file, suggesting extraction of an embedded payload disguised via custom Base64 encoding inside a picture. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PE File Creation Following Image File Access By Scripting Host
logsource:
  category: file_event
  product: windows
detection:
  selection_creator:
    Image|endswith:
    - \\powershell.exe
    - \\pwsh.exe
    - \\python.exe
    - \\cscript.exe
    - \\wscript.exe
  selection_target:
    TargetFilename|endswith:
    - .exe
    - .dll
  filter_installers:
    TargetFilename|contains:
    - \\Windows\\Temp\\
    - \\AppData\\Local\\Temp\\NuGet
  condition: selection_creator and selection_target and not filter_installers
falsepositives:
- Legitimate build scripts or installers that use scripting hosts to write executables
  to disk
- Software update mechanisms that unpack executables from downloaded resource files
level: medium
tags:
- attack.t1027
- attack.t1027.009
- attack.stealth
id: bd371996-139e-5cfa-8ee3-83ff0e02ea26
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33072

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs