# Malicious JPEG hides PE via custom BASE64

Published: 2026-06-15 · Severity: medium
Canonical: https://vorant.io/reports/8a2779ea-7842-5056-8332-3ad7f04b844a/malicious-jpeg-hides-pe-via-custom-base64

> SANS ISC analyzed a malicious JPEG file embedding a Windows executable through custom BASE64 encoding where the letter 'A' is replaced with '#' and the payload is reversed.

SANS Internet Storm Center handler Didier Stevens conducted a technical analysis of a malicious JPEG file that embeds a Windows PE executable using a custom BASE64 encoding scheme. The analysis revealed that nearly half (45.65%) of the file content consists of BASE64 characters, with the longest encoded string approaching 1 million characters.

Through statistical analysis using the base64dump.py tool's new --stats feature, Stevens identified that the encoding deviates from standard BASE64 by substituting the letter 'A' with the '#' character and reversing the entire payload string. The reversed payload is identifiable by the '==' padding appearing at the beginning rather than the end, and the string ending with '...qVT' (reversed 'TVq'), which is the marker for 'MZ' indicating a Windows executable header.

This research demonstrates how statistical analysis of character frequency in suspected encoded data can help identify custom encoding schemes used by attackers to evade detection. The technique builds upon previous SANS ISC research into malicious images with embedded payloads, specifically following up on handler Xavier Mertens' earlier analysis titled 'The Evil MSI Background is Back!'

## Detection guidance (public sample)

### Suspicious Base64 Decode Command Referencing Image File (Embedded PE Extraction)

ATT&CK: T1027.009

Detects command-line use of certutil, PowerShell, or similar utilities to decode base64 content sourced from a JPEG/image file, consistent with extracting a hidden PE payload embedded via custom BASE64 encoding. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Base64 Decode Command Referencing JPEG or Image File
id: 8250086b-ee6b-5fd1-9716-d5b9c6d81a58
status: experimental
description: 'Detects command lines invoking base64 decoding utilities (certutil,
  PowerShell FromBase64String, etc.) that reference a .jpg/.jpeg/.png file as input
  or output. This pattern is consistent with extracting an embedded PE executable
  hidden inside an image via custom or standard BASE64 encoding, a technique used
  to evade detection by disguising payloads as image files.

  '
references:
- https://isc.sans.edu/
author: Vorant
tags:
- attack.t1027.009
- attack.t1027
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_decode_tools:
    Image|endswith:
    - \certutil.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - -decode
    - FromBase64String
    - -decodehex
  selection_image_ref:
    CommandLine|contains:
    - .jpg
    - .jpeg
    - .png
    - .bmp
  filter_common_admin:
    CommandLine|contains:
    - Get-Help
    - -WhatIf
  condition: selection_decode_tools and selection_image_ref and not filter_common_admin
falsepositives:
- Legitimate certutil usage to decode certificate files that happen to share generic
  terms
- Developer or forensic tooling that manipulates images and base64 data for benign
  purposes
level: high
```

### PowerShell Script Extracting and Executing Payload From Image File

ATT&CK: T1204.002

Detects PowerShell command lines that read an image file's bytes, perform base64/string manipulation, and then invoke execution (Invoke-Expression, Start-Process, or reflective load), matching the pattern of extracting a hidden PE from a JPEG and running it. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PowerShell Reads Image File and Executes Extracted Content
id: fdf6c3cd-150a-5bf1-b624-04570fa7fcdc
status: experimental
description: 'Detects PowerShell activity that reads bytes/content from an image file
  (.jpg/.jpeg/.png) and subsequently invokes execution primitives such as Invoke-Expression,
  IEX, Start-Process, or reflective assembly loading. This matches the behavior of
  malware that hides a PE payload inside a JPEG using custom BASE64 encoding and then
  extracts and executes it in memory.

  '
references:
- https://isc.sans.edu/
author: Vorant
tags:
- attack.t1204.002
- attack.t1027
- attack.t1027.009
logsource:
  category: process_creation
  product: windows
detection:
  selection_image_read:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - .jpg
    - .jpeg
    - .png
  selection_exec_primitive:
    CommandLine|contains:
    - IEX
    - Invoke-Expression
    - Start-Process
    - Reflection.Assembly
    - FromBase64String
  condition: selection_image_read and selection_exec_primitive
falsepositives:
- Image processing automation scripts that legitimately read image bytes and separately
  call unrelated cmdlets
- Security tooling or sandbox scripts that intentionally test image-based payload
  extraction
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33072

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8a2779ea-7842-5056-8332-3ad7f04b844a/malicious-jpeg-hides-pe-via-custom-base64.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup