Breaking Down an Access-Code-Gated Malware Delivery Chain
Joe Security's Blog
In this post, we present an interesting malware delivery chain observed through Joe Sandbox Cloud Basic. At first glance, the sample appears difficult to analyze dynamically: execution is gated by an access code, the second stage is protected by time-based checks, and additional packing is applied. As a result, dynamic analysis alone is insufficient to fully uncover the attack.
To overcome these obstacles, we combine Joe Reverser and Joe Sandbox to reconstruct the full delivery chain, from the initial phishing email to the final payload. This case highlights how static analysis can be used to bypass execution barriers and enable effective dynamic confirmation at later stages.
Phishing Email
hxxps://docu[.]sign-platform[.]app/
https://www.docusign.com/
A detailed report of this stage is available in the full analysis.
The page ultimately serves a file named:
DocuSign_PackageInstaller.exe
Fake Installer & Second Stage
The downloaded executable was first analyzed in Joe Sandbox. At this stage, the analysis produced no meaningful behavioral results, suggesting evasive behavior or delayed execution logic.
.png)
.png)
.png)
.png)
.png)
.png)
4. Second-Stage Discovery Without Access Code
Despite the access code requirement, Joe Reverser was able to statically identify and retrieve the second-stage payload without providing the code. This is achieved purely through static analysis, allowing the entire delivery chain to be followed even when interactive conditions are unmet.
.png)
.png)
5. Native Second-Stage Binary and Time Bomb
The second-stage payload is a native binary. Joe Reverser automatically disassembled and decompiled it, revealing a built-in time bomb early in the analysis.
Importantly, the malware does not rely on local system time. Instead, it performs the time check using an online source, making simple clock manipulation ineffective.
.png)
.png)
.png)
.png)
6. Packing Detection
Further analysis revealed classic packing techniques, indicating that additional obfuscation layers are applied to hinder reverse engineering.
.png)
Final Payload
Full Analysis here.
Final Words
This attack chain is particularly interesting due to several factors: the use of a valid code-signing certificate, an access-code–gated second stage, online time-based execution checks, and layered obfuscation. Together, these techniques demonstrate a deliberate effort to evade both users and automated analysis.
The combination of Joe Reverser and Joe Sandbox proved effective in overcoming these challenges. Static analysis enabled the full delivery chain to be reconstructed without fulfilling runtime conditions, while dynamic analysis provided final payload confirmation. This case highlights how both tools complement each other when investigating modern, multi-stage malware campaigns.
Would you like to try Joe Reverser? Register for a free account on Joe Sandbox Cloud Basic and start using it!