I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a breakpoint on GetProcAddress() and I ran it. Then I saw decoded API names like OpenProcess, CreateMutex etc..

But I could not find its location in malware I'm analyzing. So, I cannot identify API parameters.

How can I do this?

Screenshot showing the

  • I'm not sure what "its location in malware" is refering to. Do you mean that you cannot find the IAT that gets constructed? Posting the disassembly in a code-tag, instead of a screenshot (parts are missing) would probably help too. – Tobias Nov 30 '19 at 1:36
  • Hi and welcome to RE.SE! This is a rather unspecific question, really. Loads of techniques exist to obfuscate the use of APIs. Sometimes certain functions are simply kept in the import table to make sure the respective DLL gets loaded (I think some packers also do this) and then you could have function names being identified by some checksum ("hash") being compared to those computed from the export table of a loaded DLL. Similarly the name of the DLL might be disguised. Best would be to look at the site of the GetProcAddress call and check call stack and so on to identify the method ... – 0xC0000022L Dec 6 '19 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.