If I understand this correctly, there is PHP code (preg_replace) in the jpg exif header filled into the preg_replace function in the executable. The executable

If I understand this correctly, there is PHP code (preg_replace) in the jpg exif header filled into the preg_replace function in the executable. The executable looks clean that way. The executable finds the jpg via hard-coded file path. Seems possible that the malicious code could appear in an image itself and be flagged with a simple but distinct header. The executable could just scan display memory for the simple header and execute subsequent code when header is found. Then when a user browses the image on a website, the code is executed without hard-coding the location. Pure speculation. Such an executable may be too visible. In any case it seems the essential problem of the preg_replace or some kind of PHP executable command would still be the red flag to find such malware.