Signature Detail

HTTP: Response is not JPEG/GIF/PNG/BMP

This signature is triggered if a mismatch is detected between the content type "image/jpeg" and the actual data. The signature detects if HTTP response is not starting with JPEG, GIF or PNG magic bytes. Recent malware Command and Control ("C&C") channels use encrypted data with "jpeg" content-type, but they are not well-formed JPEG/GIF/PNG files and will be detected by this signature.