RtlGetVersion OS Build Gating

An anti-sandbox / anti-emulation gate that resolves RtlGetVersion from ntdll.dll at runtime, fills an OSVERSIONINFOEXW struct, and validates dwBuildNumber against a hardcoded minimum (e.g. 0x55f0 = 22000, Windows 11 / Server 2022). If the build number is below the threshold, the gated payload branch is skipped. This evades analysis sandboxes that run on older Windows builds (Windows 7 / Server 2008 R2 are common in sandbox farms).

Detection / Fingerprint

• Runtime resolution of RtlGetVersion via GetModuleHandleW("ntdll.dll") → GetProcAddress
• OSVERSIONINFOEXW struct size 0x114 (276 bytes) pushed on stack before call
• Hardcoded build-number threshold in .rdata or immediate operand (e.g. cmp dword [var_108h], 0x55f0)
• Often paired with IsDebuggerPresent import (residual anti-debug)

Observed In

• phorpiex campaign thin MSVC9 droppers ^[/intel/analyses/2ffc320332ff30d80c0a1da728aa59db136438338409cf01a96b71e488d21b67.html] ^[/intel/analyses/6b8527a7f761e8a5489b81ea8a79cbbbd9c09485b9b5d7c28cd892ef66599339.html] ^[/intel/analyses/025f57988953e3d23e1657a9af5610887e57c5390a82f73b4b2b99c30eef3b70.html] ^[/intel/analyses/32f29422435896b7a09888a1bb42e622004fbb11d4cad2f6d6613c97ee94823f.html]

Related Techniques

• gettickcount-anti-emulation-loop — another primitive anti-emulation technique observed in the same campaign
• marker-file-mutex-gating — filesystem-based runtime gating used alongside build gating