Disclosed is a system and method for determining modified web pages. An example method includes: extracting a plurality of malware trigger code fragments from a configuration file of the malicious software; creating a verification web page by adding the plurality of malware trigger code fragments into a template page; storing, in a database, data relating to an initial state of the verification web page; opening the verification web page and identifying data relating to an opened state of the verification web page; comparing the data relating to the initial state and the data relating to the opened state of the verification web page; and based on detected differences between the data relating to the initial state and the data relating to the opened state of the verification web page, identifying at least one modified code fragment of the verification web page.