While hunting, I found an interesting picture. It's a PNG file that was concatenated with two interesting payloads. There are file formats that are good candidates to have data added at the end of the file. PNG is the case because the file format specifications says:
So how do these embedded scripts get extracted? You need a separate executable to do the actual extraction/execution?
Yes. And you will have a good chance that the EDR wont flag the extractor since its not suspicious code per se.
Interesting thanks!