Detecting Malware with Downloader Graph Analytics

I wonder how common it is for malware to obfuscate later stage payloads?

If I hide my executables inside an image (or zip, pdf, docx) and download them with URLDownloadToFile, will this evade detection?