MICROSOFT Security Research’s TerminalFix campaign investigation identified PNG files being used to conceal malware through steganography. Didier Stevens of the SANS Internet Storm Centre examined indicators shared by the researchers and found that one small, valid PNG contained a 49,720-byte Windows PE file inside its pixel data. The image had normal IHDR, IDAT and IEND chunks, no appended data or payload-bearing metadata, and valid ZLIB-compressed image data. However, examining the raw bitmap revealed executable strings including “MZ”, “.text” and “.data”, followed by the embedded PE file’s length.
The concealed file was identified as the genuine Microsoft executable `LockScreenContentServer.exe`, which the campaign uses for DLL sideloading. Unlike typical steganography, where only selected bits are altered so the image remains visually plausible, the operators used all available pixel bits; the original image was therefore lost and the PNG rendered as noisy data. Two additional PNGs each contained part of a malicious DLL. Concatenating the extracted parts produced the complete payload.
The report provides hashes and VirusTotal links for the PNGs, their extracted components and the final DLL, giving defenders material for investigation and detection.