Image modification time updated on access from 2014 posts page

We have recently had some issues with repeated hacks on our site so we’re watching things very closely now that things look back to normal.

I have one image file in my uploads directory that keeps being modified. That is, the last modified date on the file keeps being updated. I’ve run an MD5 on the file before and after this happens and the content of the file is identical, so apparently something is “touching” it and just modifying the date. No other images are being affected the same way.

This only happens if tthis image is requested via the /2014/ url on our site (showing posts from 2014). If I request the image directly the image modified date doesn’t change.

Here is the request in the Access_log that updates the modified date:
#.#.#.# – – [17/Dec/2014:08:26:14 -0400] “GET /wp-content/uploads/2014/11/images-280×174.jpg HTTP/1.1” 200 13662 “https://www.mydomain.com/2014/page/2/” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5”

And here is the direct request for the image (no refering url):
#.#.#.# – – [17/Dec/2014:08:30:23 -0400] “GET /wp-content/uploads/2014/11/images-280×174.jpg HTTP/1.1” 200 13661 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5”

I’m likely being hyper-paranoid at this point, but does this point to any kind of active content? Does anyone know what would cause the modified date to change in the first request?

Thanks!
Dean