What is encrypted in this image?

Question

In the image above apparently has a hidden link?? I don't know how to do this (even if it may seem simple for some) however I don't believe it's anything malicious. It's a part of a puzzle, but even I don't get where it will ultimately lead.

Answer 1

We begin by using steghide to reveal the payload:

http://pastebin.com/szEs3Hhq

The link brings us to a paste where we get

you've done well. Go deeper, and the rewards can be found. Difficulty will increase as you solve each test.
May you find your meaning.

486578206973206561737920656e6f7567682e204e65656420746f20676f206465657065723f0d0a0d0a4441426d696e46236d696e47444741

Let the hunt begin.

The 0d0a in there looks very suspicious (\r\n in C-like languages). Could it be a hex encoded ASCII string? Decoding gets us:

Hex is easy enough. Need to go deeper?

DABminF#minGDGA

A chord progression? For D Major, that is I V vi iii IV I IV V. A Google search doesn't turn up anything. Maybe just search the chord names? (EDIT: It's Pachelbel's "Canon in D")

That turns up a Reddit /r/N001109 post and a Youtube video of the numbers 0 0 1 1 2 1 (rajb245 suggested the beeps heard could be Morse Code). So I try /r/N001121 and its only post. Dead end. Back to the original /r/N001109 post. There's a single comment:

150 164 164 160 163 072 057 057 167 167 167 056 162 145 144 144 151 164 056 143 157 155 057 162 057 116 060 061 061 060 070 057 015 012 015 012 123 110 101 114 114 040 127 105 077 040

Looks like octal. It decodes to (there's a space after the question mark):

https://www.reddit.com/r/N01108/

SHALL WE? 

Following that takes us to /r/N01108 (obviously) with its only post:

060 061 060 061 060 061 061 061 040 060 061 060 060 061 060 060 060 040 060 061 060 060 060 061 060 061 040 060 061 060 060 061 061 061 060 040 060 060 061 060 060 060 060 060 040 060 061 060 060 060 061 060 060 040 060 061 060 060 061 061 061 061 040 060 061 060 060 060 061 060 061 040 060 061 060 061 060 060 061 061 040 060 060 061 060 060 060 060 060 040 060 061 060 061 060 061 060 060 040 060 061 060 060 061 060 060 060 040 060 061 060 060 060 061 060 061 040 060 060 061 060 060 060 060 060 040 060 061 060 061 060 060 061 060 040 060 061 060 060 060 060 060 061 040 060 061 060 060 060 060 061 060 040 060 061 060 060 060 060 061 060 040 060 061 060 060 061 060 060 061 040 060 061 060 061 060 061 060 060 040 060 060 061 060 060 060 060 060 040 060 061 060 060 061 060 060 060 040 060 061 060 060 061 061 061 061 040 060 061 060 060 061 061 060 060 040 060 061 060 060 060 061 060 061 040 060 060 061 060 060 060 060 060 040 060 061 060 060 060 061 060 061 040 060 061 060 060 061 061 061 060 040 060 061 060 060 060 061 060 060 040 060 060 061 061 061 061 061 061 040 060 060 060 060 061 060 061 060 040 060 061 060 060 061 061 060 060 040 060 061 060 060 060 060 061 061 040 060 061 060 060 060 060 060 061 040 060 061 060 061 060 060 061 060 040 060 061 060 061 060 060 061 060 040 060 061 060 060 061 061 061 061 040 060 061 060 060 061 061 060 060 040 060 061 060 060 061 061 060 060 040 060 060 061 060 060 060 060 060 040 060 061 060 060 060 061 061 061 040 060 061 060 061 060 061 060 061 040 060 061 060 061 060 061 060 060 040 060 061 060 060 060 061 060 061 040 060 061 060 060 061 061 061 060 040 060 061 060 060 060 060 061 060 040 060 061 060 060 060 061 060 061 040 060 061 060 061 060 060 061 060 040 060 061 060 060 060 061 061 061 040 060 060 061 060 060 060 060 060 040 060 061 060 061 060 060 060 060 040 060 060 061 061 060 060 061 060 040 060 060 061 061 060 061 060 061 040 060 061 060 060 061 061 060 060 040 060 060 061 061 060 060 061 061 040 060 060 061 061 060 061 060 061 040 060 060 061 060 061 061 061 061 040 060 060 061 061 060 060 061 061 040 060 060 061 061 060 061 061 060 040 060 060 060 060 061 060 061 060 040 060 060 061 061 060 060 060 061 040 060 061 060 060 061 061 060 061 040 060 061 060 060 061 061 061 061 040 060 061 060 060 061 061 061 060 040 060 061 060 061 060 061 060 060 040 060 061 060 060 061 060 060 060 040

Another octal encoded string (with another random space at the end)!

01010111 01001000 01000101 01001110 00100000 01000100 01001111 01000101 01010011 00100000 01010100 01001000 01000101 00100000 01010010 01000001 01000010 01000010 01001001 01010100 00100000 01001000 01001111 01001100 01000101 00100000 01000101 01001110 01000100 00111111 00001010 01001100 01000011 01000001 01010010 01010010 01001111 01001100 01001100 00100000 01000111 01010101 01010100 01000101 01001110 01000010 01000101 01010010 01000111 00100000 01010000 00110010 00110101 01001100 00110011 00110101 00101111 00110011 00110110 00001010 00110001 01001101 01001111 01001110 01010100 01001000 

Huh. Octal encoded binary encoded ASCII?

WHEN DOES THE RABBIT HOLE END?
LCARROLL GUTENBERG P25L35/36
1MONTH

A reference to the Gutenberg project and Alice in Wonderland (the post is titled "alice")? The PDF's 25th page, lines 35 and 36 read:

'If everybody minded their own business,' the Duchess said in a hoarse growl, 'the world
would go round a deal faster than it does.'

That's a dead end for what I will assume to be a month. Back to the post, let's look at the comment:

newsyyyodhfssnviqwlbjnyqibxaeytcuy.kumetgn.bij

Maybe its reply?

31 32 34 20 31 31 31 20 31 32 34 20 31 31 34 20 31 30 35 20 31 31 37 20 31 30 36 20 31 31 32 20 31 32 30 20 31 30 37

Looks like hex. Decoding gets us:

124 111 124 114 105 117 106 112 120 107

An octal string. Decoding gets us:

TITLEOFJPG

Could the jumbled string of letters be a string encrypted with the title of the original image? Now we're stuck because we don't know the original name. I tried a reverse Google Image search, but that turned up nothing.

Answer 2

Taking a similar path like Cole Johnson but with a different result.

Starting with the first comment: pastebin.com/szEs3Hhq by Gabriel Santos. This is the biggest doubt. I do not see a hint that the URL is embedded in that image.

Of course I find:

you've done well. Go deeper, and the rewards can be found. Difficulty will increase as you solve each test.
May you find your meaning.

486578206973206561737920656e6f7567682e204e65656420746f20676f206465657065723f0d0a0d0a4441426d696e46236d696e47444741

Let the hunt begin.

Decoding the hex gives:

irb(main):002:0> str = "486578206973206561737920656e6f7567682e204e65656420746f20676f206465657065723f0d0a0d0a4441426d696e46236d696e47444741"
=> "486578206973206561737920656e6f7567682e204e65656420746f20676f206465657065723f0d0a0d0a4441426d696e46236d696e47444741"
irb(main):005:0> str.to_byte_string  
=> "Hex is easy enough. Need to go deeper?\r\n\r\nDABminF#minGDGA"

Googling DABminF#minGDGA has a YouTube video as first hit https://www.youtube.com/watch?v=R_z2MKvyals The narrator says N0112. The video looks like this. Note the 434 in the upper left corner

Finding this post https://www.reddit.com/r/N001121. Which now has a second comment.

66 61 40 66 66 40 66 60 40 64 60 40 66 61 40 66 64 40 66 61 40 64 60 40 66 61 40 66 66 40 66 63 40 64 60 40 66 61 40 66 66 40 66 64 40 64 60 40 66 61 40 66 64 40 66 65 40 64 60 40 66 61 40 66 64 40 66 62 40 64 60 40 66 61 40 66 65 40 66 61 40 64 60 40 66 61 40 66 65 40 66 66 40 64 60 40 66 64 40 66 60 40 64 60 40 66 61 40 66 65 40 66 63 40 64 60 40 66 66 40 66 62 40 64 60 40 66 66 40 66 65 40 64 60 40 66 61 40 66 63 40 66 61 40 64 60 40 66 61 40 66 65 40 66 61 40 64 60 40 66 61 40 66 61 40 66 60 40 64 60 40 66 61 40 66 64 40 66 66 40 64 60 40 66 61 40 66 62 40 66 62

Authenticity is questionable; could be created by a freeloader. Nevertheless, I continue.

irb(main):007:0> str2 = '66 61 40 66 66 40 66 60 40 64 60 40 66 61 40 66 64 40 66 61 40 64 60 40 66 61 40 66 66 40 66 63 40 64 60 40 66 61 40 66 66 40 66 64 40 64 60 40 66 61 40 66 64 40 66 65 40 64 60 40 66 61 40 66 64 40 66 62 40 64 60 40 66 61 40 66 65 40 66 61 40 64 60 40 66 61 40 66 65 40 66 66 40 64 60 40 66 64 40 66 60 40 64 60 40 66 61 40 66 65 40 66 63 40 64 60 40 66 66 40 66 62 40 64 60 40 66 66 40 66 65 40 64 60 40 66 61 40 66 63 40 66 61 40 64 60 40 66 61 40 66 65 40 66 61 40 64 60 40 66 61 40 66 61 40 66 60 40 64 60 40 66 61 40 66 64 40 66 66 40 64 60 40 66 61 40 66 62 40 66 62'
#Some iterations of adding more and more transformations. 
#Converting from  octed and decimal in several iterations
#Finally this turns up:
irb(main):025:0> str2.split(" ").collect do |x| x.oct end.collect do |x| x.chr end.join("").split(" ").collect do |x| x.oct end.collect do |x| x.chr end.join("").split(" ").collect do |x| x.oct end.collect do |x| x.chr end.join ""
=> "pastebin k25YiHfR"

This pastebin URL shows this (http pastebin dot com/ k25YiHfR):

YjI1bElHUmhlU0J0WVhKcGJ5QjNiMnRsSUhWd0lHRnVaQ0JrWldOcFpHVmtJSFJ2SUhSaGEyVWdZU0J6YUdsMElHSmxZMkYxYzJVZ2FHVjVJR2hsSjNNZ2JXRnlhVzh1SUhOdklHMWhjbWx2SUhkbGJuUWdkWEFnZEc4Z2VXOXphR2tnWVc1a0lITmhhV1FnSW5sdmMyaHBJR2tnZDJGdWRDQjViM1VnZEc4Z1ltVWdiWGtnYzJocGRIUmxjaUlnWVc1a0lITnBibU5sSUhsdmMyaHBJSGRoY3lCdFlYSnBieWR6SUdKcGRHTm9JR2hsSUc5d1pXNWxaQ0JvYVhNZ2JXOTFkR2d1SUcxaGNtbHZJSEIxYkd4bFpDQmtiM2R1SUdocGN5QnpkR0ZwYm1Wa0lHSnlhV1ZtY3lCaGJtUWdZbVZuWVc0Z2RHOGdjMmhwZENCcGJpQjViM05vYVNkeklHMXZkWFJvTGlCNWIzTm9hU0IzWVhNZ1ptOXlZbWxrWkdWdUlIUnZJR1Y0Y0hKbGMzTWdZVzU1SUdWdGIzUnBiMjV6SUdKMWRDQmhkQ0IwYUdseklHMXZiV1Z1ZENCb1pTQjNZWE1nWm1WbGJHbHVaeUIyWlhKNUlHRnliM1Z6WldRdUNtMWhjbWx2SjNNZ1ptRmpaU0IwZFhKdVpXUWdjbVZrSUdGeklHaGxJR2R5ZFc1MFpXUWdZVzVrSUhOMGNtRnBibVZrSUhSdklIQjFjMmdnYUdseklHeHZaeUJ2WmlCemFHbDBJRzkxZENCdlppQm9hWE1nWVhOekxpQm9aU0JtWVhKMFpXUWdZVzVrSUd4cGRIUnNaU0J6YUdsMElIQmhjblJwWTJ4bGN5Qm1iR1YzSUdsdWRHOGdlVzl6YUdrbmN5QmxlV1Z6TGlCNWIzTm9hU2R6SUdWNVpYTWdkR1ZoY21Wa0lIVndMQ0J1YjNRZ1puSnZiU0IwYUdVZ2NHRnBiaUJ2WmlCMGFHVWdjMmhwZENCd1lYSjBhV05zWlhNZ2JtOXlJR1p5YjIwZ2RHaGxJSEJoYVc1MExYQmxaV3hwYm1jZ2MzUmxibU5vSUdOdmJXbHVaeUJtY205dElHMWhjbWx2SjNNZ2RXNTNZWE5vWldRZ1lYTnpMQ0JpZFhRZ1puSnZiU0IwYUdVZ2MyaGxaWElnWldOemRHRnplU0J2WmlCaVpXbHVaeUJ0WVhKcGJ5ZHpJSE5vYVhSMFpYSXVJRzFoY21sdklHNXZkR2xqWldRZ2RHaHBjeUJoYm1RZ1ltVm5ZVzRnZEc4Z1ozSjFiblFnYUdGeVpHVnlMQ0IwWldGemFXNW5JSFJvWlNCb2IzSnVlU0JpWldGemRDNEtiV0Z5YVc4Z2JtOTBhV05sWkNCMGFHRjBJSGx2YzJocElIZGhjeUJtYVdSa2JHbHVaeUJoY205MWJtUWdkMmwwYUNCb2FYTWdaR2x1YnkxM2FXVnVaWElzSUhkb2FXTm9JR2hoWkNCaVpXTnZiV1VnY1hWcGRHVWdaWEpsWTNRdUlDSnpkRzl3SUhSb1lYUWdkR2hwY3lCcGJuTjBZVzUwSWlCamIyMXRZVzVrWldRZ2JXRnlhVzhzSUc1dmRHbGphVzVuSUdocGN5QnZkMjRnTWkxcGJtTm9aWElnZDJGeklHZHliM2RwYm1jZ2FHRnlaQ0JoY3lCM1pXeHNMaUI1YjNOb2FTQjNhR2x1WldRZ1lXNWtJSEpsYkhWamRHRnVkR3g1SUd4dmQyVnlaV1FnYUdseklHaGhibVJ6TGlCM2FYUm9JR0VnWm1sdVlXd2daM0oxYm5RZ1lXNWtJR0VnYzIxbGJHeDVJR1poY25Rc0lHMWhjbWx2SjNNZ2JHOW5JRzltSUhOb2FYUWdabWx1WVd4c2VTQmtjbTl3Y0dWa0lHWnliMjBnYUdseklHRnpjeUJwYm5SdklIbHZjMmhwSjNNZ2JXOTFkR2d1Q20xaGNtbHZJSFIxY201bFpDQmhjbTkxYm1RZ1lXNWtJSGRoZEdOb1pXUWdZWE1nZVc5emFHa2dZMmhsZDJWa0lIUm9aU0J6YUdsMElHeHZaeTRnSW1WaGRDQnBkQ0JpYVhSamFDNGdaV0YwSUdsMElHRnNiQ0lnYzJGcFpDQnRZWEpwYnk0Z2VXOXphR2tnY0hKbGRHVnVaR1ZrSUdobElHaGhkR1ZrSUdSdmFXNW5JSFJvYVhNZ2MyOGdiWFZqYUNCaWRYUWdhR2x6SUhSb2NtOWlZbWx1WnlCM2FXVnVaWElnWVc1a0lHMXZZVzV6SUc5bUlHcHZlU0IwYjJ4a0lHMWhjbWx2SUc5MGFHVnlkMmx6WlM0Z0luTjNZV3hzYjNjZ2FYUWlJRzl5WkdWeVpXUWdiV0Z5YVc4Z1luVjBJSGx2YzJocElHUnBaRzRuZENCM1lXNTBJSFJ2SUhOM1lXeHNiM2NnYVhRZ2VXVjBMaUJvWlNCM1lXNTBaV1FnZEc4Z2MyRjJiM0lnZEdobElITm9hWFF1SUNKVFYwRk1URTlYSUVsVUlGSkpSMGhVSUU1UFZ5SWdjMk55WldGdFpXUWdiV0Z5YVc4Z1lYTWdhR1VnWW1WbllXNGdkMkZ1WnkxemJHRndjR2x1WnlCNWIzTm9hU0JoWTNKdmMzTWdkR2hsSUdaaFkyVXVDbTFoY21sdkxDQm9ZVzVrY3lCdmJpQm9hWE1nYUdsd2N5d2dkR2h5ZFhOMElHaHBjeUJ3Wld4MmFYTWdabkp2YlNCemFXUmxJSFJ2SUhOcFpHVWdZV055YjNOeklIbHZjMmhwSjNNZ1ptRmpaU3dnY0hWdWFYTm9hVzVuSUhSb1pTQnVZWFZuYUhSNUlHUnBibTl6WVhWeUxpQWlXVTlWSUVSUElGZElRVlFnVFVGU1NVOGdWRVZNVEZNZ1dVOVZJaUJvWlNCelkzSmxZVzFsWkM0Z1lXWjBaWElnWVdKdmRYUWdabTkxY25SNUlIZGhibWN0YzJ4aGNITWdhR2x6SUhkcFpXNWxjaUJ6ZEdGeWRHVmtJSFJ2SUdKbFkyOXRaU0J6YjNKbElITnZJR2hsSUhOMGIzQndaV1F1SUdKNUlHNXZkeUIwYUdVZ2MyaHBkQ0JzYjJjZ2FHRmtJR2R2Ym1VZ1pHOTNiaUI1YjNOb2FTZHpJSFJvY205aGRDNGdJbVZuWjNWc1lYUmxJaUJvWlNCdmNtUmxjbVZrTGlCNWIzTm9hU0J6ZEhKaGFXNWxaQ0JoYm1RZ2NISnZaSFZqWldRZ1lXNGdaV2RuTGlCcGJuTnBaR1VnZEdocGN5QmxaMmNnWTI5dWRHRnBibVZrSUhkb1lYUWdkMkZ6SUhCeVpYWnBiM1Z6YkhrZ2FHbHpJSE5vYVhRZ2JHOW5MaUJ0WVhKcGJ5QjNZV3hyWldRZ2IzWmxjaUIwYnlCb2FYTWdjMmhsYkdZZ1lXNWtJSEJzWVdObFpDQnBkQ0IzYVhSb0lIUm9aU0J2ZEdobGNuTXVJR2hsSUdoaFpDQm9kVzVrY21Wa2N5QndiM056YVdKc2VTQjBhRzkxYzJGdVpITWdiMllnZEdobGMyVWdjMmhwZEMxbFoyZHpMaUJvWlNCd2JHRnVibVZrSUhSdklIVnpaU0IwYUdWelpTQmhaMkZwYm5OMElHSnZkM05sY2lCMGFHVWdibVY0ZENCMGFXMWxJR2hsSUd0cFpHNWhjSEJsWkNCd1pXRmphQzQ9

Decoding this twice:

irb(main):027:0> str3 = 'YjI1b.....'
irb(main):034:0> Base64.decode64(Base64.decode64(str3))
=> "<some explicit text about Mario and Yoshi; decode it yourselves>"

Conclusion: The entry point is questionable and if the riddle path was not already corrupted by some freeloader is also possible.

Answer 3

Some additional "analysis" of the image (potentially useless). All based on the image downloaded here (as a BMP file)

• Image size 800 x 600 is not suspicious

• All RGB values are grey-values (No difference in red/green/blue)
  

  Considering grey-level values in further analysis only.

• 4843 non-black (non-zero) pixels in total. The image below is a binary-map of those pixels.

• A full pixel value histogram: http://pastebin.com/vZ7qHt7m
  

• Summing pixel grey-values horizontally & vertically in the both the original and the "binary mask" image yields:

  • 
  • vertical sum (original): http://pastebin.com/6cUTt7JQ
  • vertical sum (binary): http://pastebin.com/cprLUTHv
  • horizontal sum (original): http://pastebin.com/bQT2p5xj
  • horizontal sum (binary): http://pastebin.com/guq4xZpE