Images in your Approved Images or Blocked Images lists are not triggering in Symantec Email Security.cloud.
The Approved Images and Blocked Images lists use a file's MD5 hash value. Therefore, the lists only matches against image files that are identical to those you previously submitted. Any change to an image file results in a different MD5 hash value, which prevents Symantec.cloud from identifying it.
To obtain an image from an email without modifying its hash value, save the email as HTML. This extracts its contents, including images, which you can upload to the Approved Images or Blocked Images list.
You may need to compare the MD5 hash value of an image present in the Approved Images or Blocked Images lists against the MD5 hash value of another image (either found through Email Track and Trace, or extracted from an email).
See How to compute the MD5 or SHA-1 cryptographic hash values for a file on Microsoft.com.