HijackLoader IDAT Chunks Concealed in XML or MAP File
Detects disguised malicious files, typically mimicking XML or MAP documents, that contain multiple PNG IDAT chunk markers but lack a valid PNG header and XML declaration. This signature is consistent with the HijackLoader staging technique, where XOR-encrypted and LZNT1-compressed data is hidden within the structure of spoofed file formats.
YARA
