x64 Architecture Check via Program Files (x86)

An anti-sandbox / anti-emulation gate that checks for the presence of the %SYSTEMDRIVE%\Program Files (x86) directory via PathFileExistsW. This directory only exists on 64-bit Windows installations; on 32-bit systems or heavily stripped sandboxes the check fails and the gated payload branch is skipped.

Detection / Fingerprint

• ExpandEnvironmentStringsW("%SYSTEMDRIVE%", ...) followed by wsprintfW("%s\Program Files (x86)")
• PathFileExistsW call on the formatted path
• Return value used as a boolean gate before payload execution
• Often paired with RtlGetVersion build-number gating in the same campaign

Observed In

• phorpiex campaign thin MSVC9 dropper f67e429d ^[/intel/analyses/f67e429d359aa88c0101af1c086ca42f18955b6e8ee799d88a095bdbc4e6fccc.html]

Related Techniques

• rtlgversion-build-gating — OS build-number gate often used alongside this arch check
• marker-file-mutex-gating — filesystem-based runtime gating in the same campaign