Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A common occurance I've found when doing forensics on compromised websites is a pattern like this:

<span>Clean code here</span>

... malware code here ...

<div>clean code resumes</div>

In particular, HTML code is delimited with <!--marker--> ... <!--/marker-->, PHP code with #marker# ... #/marker# and JavaScript with /*marker*/ ... /*/marker*/. Where the marker is some 6-character alphanumeric (possibly hexadecimal) value which varies by infection but is consistent throughout all the files infected in one go.

So my question is this:
Is there a common tool that produces this pattern, or is it perhaps a single individual or group? Or otherwise why is this pattern so consistent and common?

share|improve this question

This seems to be a way for the malware to check whether it has already infected the file or not. No tool is needed, it could be something as easy as hex-coded string that means something to the malware author, or it could simply be a randomly generated string of some pattern to help the malware identify its own code in the infected pages.

I have seen similar techniques in several infected websites.

share|improve this answer
Yes, what it's for is pretty easy to tell. It also makes the infection easily reversible, which could prove handy. But what's remarkable is that it ALWAYS uses the escaping for the markers. It's not just a common theme, it's perfectly consistent, which makes me think a tool rather than someone by hand. – tylerl Jul 24 '13 at 17:39
@tylerl Of course it's not by hand, but I don't see why a separate tool should be involved. It's simple the malware itself writing those comments before and after the malicious code in the files. I don't see anything remarkable here. You're very likely just facing an infection by only one type of malware (and possibly its variantes), so it's expected to see consistency. – Adi Jul 24 '13 at 17:44
so the question is, what type of malware? I've personally seen well over 600 different and independent sites infected over several years that all follow this same pattern. But the infection tool itself never shows up on the server. Id love to find out what it is. – tylerl Jul 24 '13 at 18:12
@tylerl It's very common for organized and semi-organized cybercriminals to mass infect web servers to serve up exploit kits. Generally the Javascript you are seeing is part of a "trampoline" that will redirect the user to the actual kit. The trampoline code is indeed inserted automatically by custom scripts the criminals use; many groups may share the same scripts for these purposes, and in some cases they use a unified web interface to perform this kind of injection. The tagging is there so they don't double-inject, and also to show prospective buyers "hey, I have ID 6a787df" as proof. – Anorov Jul 25 '13 at 12:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.