Malware Word Search: Identifying Angler’s Dictionary

This post authored by Steve Poulson with contributions from Nick Biasini.

Exploit kits are constantly evolving and changing. We recently wrote about some subtle Angler changes but then Angler changed drastically on March 8. In this blog post, we will briefly cover these changes, examining different characteristics of the URL structure for Angler and the origins of the words being leveraged to create them.

New Angler

Beginning on March 8, Talos noticed some major changes to the URL structure for Angler. These changes were drastic and have altered every part of the URL for the landing pages. Let’s first look at the old syntax:

e.serenawilliamsbeauty.com/forum/view.php?forum_id=t4g&id=tnm9epz5bt3cua9snw8b1etdv2fd46zmo5-6s4n94yeh023g_y8ym2896c-0fnmmzxpec27qye_x2dswec8dgxxapds5ngbt3