In reply to Igor.

The PNG is a valid image with the malicious code after the IEND tag, so most display tools just display the image and ignore the data after the IEND tag. The PNG by itself does not have the ability to load the malicious code stored in it.