# Malicious JPEG uses reversed BASE64 encoding

Published: 2026-06-15 · Severity: medium
Canonical: https://vorant.io/reports/317b1547-b8a1-4f62-8552-8cb9b17a2940/malicious-jpeg-uses-reversed-base64-encoding

> SANS ISC handler demonstrates reversing a custom BASE64 encoding scheme in a malicious JPEG file that hides a Windows PE payload using character substitution and string reversal.

SANS ISC senior handler Didier Stevens analyzed a malicious JPEG file containing embedded Windows executable code disguised through custom BASE64 encoding. The analysis built upon Xavier Mertens' earlier work identifying the "Evil MSI Background" campaign. Using byte-stats.py and base64dump.py tools, Stevens identified that nearly half the file content (45.65%) consisted of BASE64 characters, with the longest encoded string approaching 1 million characters.

The payload employed two layers of obfuscation: first, the letter 'A' in standard BASE64 was replaced with the '#' character; second, the entire encoded string was reversed, placing the padding characters '==' at the beginning rather than the end. The reversed string ended with '...qVT' which, when reversed to 'TVq', revealed the 'MZ' header marker of a Windows PE executable.

This research demonstrates advanced evasion techniques used to embed malicious executables in image files. Stevens enhanced his base64dump.py tool with a new --stats option that provides character frequency analysis to aid in identifying custom encoding schemes. The extracted payload matched the hash of the file previously analyzed by Xavier Mertens, confirming the presence of the malicious executable.

## Mentioned in this report

- Campaigns: Evil MSI Background

## Detection guidance (public sample)

### Suspicious PowerShell Extraction of Embedded Payload from Image File

ATT&CK: T1027.009

Detects PowerShell command lines that read an image file and pipe its content through Base64 decoding functions, consistent with extracting an embedded executable hidden in a JPEG/PNG. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious PowerShell Extraction of Embedded Payload from Image File
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \\powershell.exe
    - \\pwsh.exe
  selection_read:
    CommandLine|contains:
    - .jpg
    - .jpeg
    - .png
    - .bmp
  selection_decode:
    CommandLine|contains:
    - FromBase64String
    - -join
    - 'Convert]::'
    - Get-Content -Raw
  filter_common:
    CommandLine|contains:
    - Resize-Image
    - Get-ItemProperty
  condition: selection_img and selection_read and selection_decode and not filter_common
falsepositives:
- Legitimate image-processing or automation scripts that combine image files and Base64
  operations for benign encoding tasks
- Developer/debugging scripts that manipulate image byte arrays
level: high
tags:
- attack.t1027.009
- attack.t1140
- attack.defense_evasion
id: e2f3171d-90e8-563a-8757-55756434dfcc
status: experimental
author: Vorant
```

### Certutil or Similar Utility Decoding Payload from Image File

ATT&CK: T1140

Detects use of certutil.exe or similar built-in decoding utilities against files with image extensions, a pattern consistent with extracting a Base64-encoded executable embedded in a picture file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Certutil Decode Operation Targeting Image File
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
    - \\certutil.exe
  selection_decode_flag:
    CommandLine|contains:
    - -decode
    - /decode
  selection_image_ext:
    CommandLine|contains:
    - .jpg
    - .jpeg
    - .png
    - .bmp
    - .gif
  condition: selection_tool and selection_decode_flag and selection_image_ext
falsepositives:
- Rare legitimate administrative use of certutil to decode certificate files that
  happen to be misnamed with image extensions
level: high
tags:
- attack.t1140
- attack.t1027
- attack.defense_evasion
id: 9d8ffdf2-5b32-5b79-a207-c265494757f1
status: experimental
author: Vorant
```

### Executable File Written Immediately After Reading Image File Content

ATT&CK: T1027

Detects a script interpreter or utility process creating a new PE (.exe/.dll) file shortly after opening or reading an image file, suggesting extraction of an embedded payload disguised via custom Base64 encoding inside a picture. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PE File Creation Following Image File Access By Scripting Host
logsource:
  category: file_event
  product: windows
detection:
  selection_creator:
    Image|endswith:
    - \\powershell.exe
    - \\pwsh.exe
    - \\python.exe
    - \\cscript.exe
    - \\wscript.exe
  selection_target:
    TargetFilename|endswith:
    - .exe
    - .dll
  filter_installers:
    TargetFilename|contains:
    - \\Windows\\Temp\\
    - \\AppData\\Local\\Temp\\NuGet
  condition: selection_creator and selection_target and not filter_installers
falsepositives:
- Legitimate build scripts or installers that use scripting hosts to write executables
  to disk
- Software update mechanisms that unpack executables from downloaded resource files
level: medium
tags:
- attack.t1027
- attack.t1027.009
- attack.defense_evasion
id: bd371996-139e-5cfa-8ee3-83ff0e02ea26
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33072

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/317b1547-b8a1-4f62-8552-8cb9b17a2940/malicious-jpeg-uses-reversed-base64-encoding.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup