1

I am performing some RE on a malware sample, and they are checking the value of SYSTEM_INFO[32] which is SYSTEM_INFO.wProcessorLevel. The description MS provides is not clear to me. The malware checks if this value is 0x0 and exits immediately. Sources online say this is to avoid malware inspection environments - when I read this value on my Windows10 PC (not in a VM, just a basic VS script), it returns 0x6. Can someone shed some light on the meaning of this SYSTEM_INFO offset?

2

for intel wProcessorArchitecture
wProcessorLevel indicates if the family is one of

386--------------->(3) ,   
486--------------->(4) ,  
pentium----------->(5) ,   
pentium2&above---->(6)

for other architectures they return different information

on my current device

:\>wmic cpu get Caption,Level,Name
Caption                                Level  Name
Intel64 Family 6 Model 142 Stepping 9  6      Intel(R) Core(TM) i3-7020U CPU @ 2.30GHz

or some c snippet

#include <windows.h>
#include <stdio.h>

int main(void) {
    SYSTEM_INFO sysinf ={0};
    GetSystemInfo(&sysinf);
    printf("%-30s = %x\n" , "wProcessorArchitecture",sysinf.wProcessorArchitecture ); //9 amd64
    printf("%-30s = %x\n" , "wProcessorLevel" ,sysinf.wProcessorLevel ); //6 pent2&above (core i3)
    printf("%-30s = %u\n" , "dwProcessorType" ,sysinf.dwProcessorType ); // 8664 AMD64
    return 0;
}

may be the malware runs selectively and infects only specific machine

or as igorsk commented some emulation environments might be returning 0

like instead of GeniuneIntel vmware or hyper-v used to return thier names which could be used to detect if running inside vms

On machines running off of Microsoft’s Hyper-V or VMware this string will be “Microsoft HV” or “VMwareVMware”.

1
  • my guess is that 0 is returned by some lazy emulation environments.
    – Igor Skochinsky
    Sep 29 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.