GetTickCount Anti-Emulation Loop

An anti-emulation technique that repeatedly calls GetTickCount (or QueryPerformanceCounter) and measures elapsed time between operations. Emulators and sandbox hooks often artificially speed up or slow down API returns; the malware compares deltas and branches differently if the timing is suspicious. A simple variant sleeps a random duration derived from GetTickCount to desynchronize analysis pipelines.

Detection / Fingerprint

• Multiple sequential GetTickCount calls with arithmetic on return values
• Sleep durations derived from rand() % N or direct GetTickCount modulo
• Often paired with srand(GetTickCount()) to seed random filename generation

Observed In

• phorpiex campaign thin MSVC9 droppers (as timing desync before download attempts)

Related Techniques

• rtlgversion-build-gating — OS build-number check used alongside timing loops
• marker-file-mutex-gating — filesystem mutex used in same campaign