Sleep and check if time have been accelerated */

Check Win32_CacheMemory for entries */

Check Caption from VideoController using WMI */

Check CIM_Memory for entries */

Check CIM_NumericSensor for entries */

Check CIM_PhysicalConnector for entries */

Check CIM_Sensor for entries */

Check CIM_Slot for entries */

Check CIM_TemperatureSensor for entries */

Check CIM_VoltageSensor for entries */

According to MSDN, this query should return a class that provides statistics on the CPU fan. Win32/OilRig checks to see if the result of this query re

If HV presence confirmed then it is good to know which type of hypervisor we have When CPUID is called with EAX=0x40000000, cpuid return the hyperviso

The CPUID instruction is a processor supplementary instruction (its name derived from CPU IDentification) for the x86 architecture allowing software t

Check Current Temperature using WMI, this requires admin privileges In my tests, it works against vbox, vmware, kvm and xen. */

This trick consists of getting information about total amount of space. This can be used to expose a sandbox. */

Check hard disk size using WMI */

DeviceIoControl works with disks directly rather than partitions (GetDiskFreeSpaceEx) We can send IOCTL_DISK_GET_LENGTH_INFO code to get the raw byte

note: templated version of this function is in Common.h

Check for generic */

Same for Global Descriptor Table (GDT) */

Detect Hybrid Analysis with mac vendor */

This trick involves looking at pointers to critical operating system tables that are typically relocated on a virtual machine. One such table is the

Check against kvm blacklisted directories */

Check for the lack of user input. This version is slightly different from the original: https://www.lastline.com/labsblog/malware-evasion-techniques/

Same for Local Descriptor Table (LDT) */

Check Manufacturer from ComputerSystem using WMI */

Check if the machine have enough memory space, usually VM get a small ammount, one reason if because several VMs are running on the same servers so th

Check Win32_MemoryArray for entries */

Check Win32_MemoryDevice for entries */

Check Model from ComputerSystem using WMI */

Check if there is any mouse movement in the sandbox. */

Check for SMBIOS tables number */

Check number of cores using WMI */

Check Parallels NIC MAC address */

Check Win32_PerfFormattedData_Counters_ThermalZoneInformation for entries */

Check Win32_PhysicalMemory for entries */

Check Win32_PortConnector for entries */

Check what power states are enabled. Most VMs don't support S1-S4 power states whereas most hardware does, and thermal control is usually not found ei

Check ProcessId from Win32_Processor using WMI KVM, XEN anv VMWare seems to return something, VBOX return NULL */

Check for ACPI firmware */

Check for SMBIOS firmware */

Detect Virtual machine by calling NtQueryLicenseValue with Kernel-VMDetection-Private as license value. This detection works on Windows 7 and does not

Check HKLM\System\CurrentControlSet\Services\Disk\Enum for values related * to virtual machines. */

Check SerialNumber devices using WMI */

Check Win32_SMBIOSMemory for entries */

The instruction STR (Store Task Register) stores the selector segment of the TR register (Task Register) in the specified operand (memory or other gen

Timing attack using CreateTimerQueueTimer. Test fails if any of the calls return an error state. */

Timing attack using waitable timers. Test fails if any of the calls return an error state. */

Another timinig attack using the API IcmpSendEcho which takes a TimeOut in milliseconds as a parameter, to wait for IPv4 ICMP packets replies. First t

Check Win32_BaseBoard */

Check Win32_Bus to see if only ACPIBus_BUS_0, PCI_BUS_0, PNP_BUS_0 are present */

Check virtualbox NIC MAC address */

Check against virtualbox blacklisted directories */

Check vbox event log using WMI */

Check vbox mac @ using WMI */

Check for shared folders network profider */

Check Win32_PnPEntity for known VirtualBox hardware */

Check vbox devices using WMI */

Check Win32_PnPDevice for VBOX entries */

Check for Window class */

Check against VMWare adapter name */

Check against VMWare blacklisted directories */

Check for ACPI firmware */

Check for SMBIOS firmware */

Check Win32_VoltageProbe for entries */

Check against Wine export dlls */

Check Xen NIC MAC address */