I found a jpeg image on a server that contained the string
<?php. The server also hosts an application written in PHP. The contents of the image that come after the string
<?php are non-ascii.
I'm unable to find anything in the file that appears to be valid PHP code, yet I'm unwilling to accept that the string
<?php appears within the file coincidentally.
The jpeg image is viewable in Windows, but clearly displays visual abnormalities about 1/3 of the way down. Saving the portion of the image that starts with
<?php as a separate jpeg image and viewing it as an image confirms that the visual abnormalities begin at the same point that the string
I'm reasonably certain that this image contains malicious PHP, but my attempts to detect executable PHP code have failed.
This image has visual abnormalities that begin at the point of the string "<?php" and continue to the bottom of the image. For testing, I've taken a different (known safe) jpeg, opened it in a text editor, and added the string "<?php" somewhere in the middle. The test image has zero visual abnormalities. This implies to me that the image in question was not only maliciously altered to contain the string "<?php", but that there were additional alterations made after the string "<?php". It seems likely that this image somehow contains executable PHP code.
Could this image indeed contain valid executable PHP that is encoded in a way as to not be readable within a text editor?
How can I confirm and/or translate the image file contents so that I may determine what the malware has done?
The image is attached
Below is the image before it was modified