What is the meaning of SYSTEM_INFO.wProcessorLevel?

Question

I am performing some RE on a malware sample, and they are checking the value of SYSTEM_INFO[32] which is SYSTEM_INFO.wProcessorLevel. The description MS provides is not clear to me. The malware checks if this value is 0x0 and exits immediately. Sources online say this is to avoid malware inspection environments - when I read this value on my Windows10 PC (not in a VM, just a basic VS script), it returns 0x6. Can someone shed some light on the meaning of this SYSTEM_INFO offset?

Answer 1

for intel wProcessorArchitecture
wProcessorLevel indicates if the family is one of

386--------------->(3) ,   
486--------------->(4) ,  
pentium----------->(5) ,   
pentium2&above---->(6)

for other architectures they return different information

on my current device

:\>wmic cpu get Caption,Level,Name
Caption                                Level  Name
Intel64 Family 6 Model 142 Stepping 9  6      Intel(R) Core(TM) i3-7020U CPU @ 2.30GHz

or some c snippet

#include <windows.h>
#include <stdio.h>

int main(void) {
    SYSTEM_INFO sysinf ={0};
    GetSystemInfo(&sysinf);
    printf("%-30s = %x\n" , "wProcessorArchitecture",sysinf.wProcessorArchitecture ); //9 amd64
    printf("%-30s = %x\n" , "wProcessorLevel" ,sysinf.wProcessorLevel ); //6 pent2&above (core i3)
    printf("%-30s = %u\n" , "dwProcessorType" ,sysinf.dwProcessorType ); // 8664 AMD64
    return 0;
}

may be the malware runs selectively and infects only specific machine

or as igorsk commented some emulation environments might be returning 0

like instead of GeniuneIntel vmware or hyper-v used to return thier names which could be used to detect if running inside vms

On machines running off of Microsoft’s Hyper-V or VMware this string will be “Microsoft HV” or “VMwareVMware”.