The earliest spam attacks used malware delivery methods that are now relatively easy to detect. The attached files were usually well-known Microsoft or Adobe files. More important, the malicious code was self-contained, being downloaded directly and not involving multiple downloads from the network. Spam attacks have evolved since that time. Malware researchers have uncovered spam attacks that are resistant to automated analysis engines (or sandboxes).
Advanced attacks initiate a chain of downloads that deliver the malicious executable as the final payload. The multistage download approach takes advantage of certain limitations of sandbox-based detection systems. First, because 100% faithful emulation is impractical, a sandbox-based malware analysis system sometimes responds to network requests with dummy data. Second, sandbox analysis periods are finite.
As an example, banking spam attacks often email their victims email attachments that contain obfuscated macros. None of the macros downloads the malicious binary. Instead, they issue network requests for remote data or files that appear to be benign. The downloaded objects, taken together, are used by another macro in the chain to obtain the final payload: a malicious executable.
Each stage of the attack employs a detection-avoidance technique. The downloader macros send decoy network requests designed to lure the analysis system into returning dummy data, thereby revealing its presence. If a downloader macro detects that it has been honey potted, it does not proceed. Instead, it suspends malicious activity until the sandbox analysis period ends. After the final download completes, the final payload—a malicious binary—executes on a victim's system. In the case of banking spam, the malware steals the victim's personal and corporate account credentials.