Yes, if you open the file as text you will find the magic number of icc profile (acsp) follwoed by a bunch of random bytes and that of zip (PK/x03/x04). It is q

Yes, if you open the file as text you will find the magic number of icc profile (acsp) follwoed by a bunch of random bytes and that of zip (PK/x03/x04). It is quite easy to append arbitrary data to JPEG files [0] and however there is no guarantee that it will survive image processing, so it was necessary to hide it within an ICC　profile. As for zip, unzip will happily decode any data stream as long as it makes sense and ignore the parts that don't. I can't quite figure out what additional tricks the author has used to disperse the image data inside the body to evade entropy analysis as shown by the binwalker analysis posted in this thread; however image processing software seems to have no trouble parsing the file and extract only the image data without the embedded zip.[1] [0]:https://natmchugh.blogspot.com/2014/10/how-i-created-two-images-with-same-md5.html https://natmchugh.blogspot.com/2014/10/how-i-created-two-ima... [1]:http://www.imagemagick.org/script/command-line-options.php#profile http://www.imagemagick.org/script/command-line-options.php#p...