Extreme Coders has provided a good answer about the IAT (Import Address Table).
This question is so abroad I was originally not going to answer but I'll try quickly summarise the sort of tools and things you'll want to look for.
Firstly, let me tell you what any imported or exported function can't really say it's used primary malware. For example, DeleteFile can be used to delete important files is considered as malware but the actual API itself can be used for common non-related malware operations.
If you want to see what APIs are actually been executed you'll want to use something like:
http://www.rohitab.com/apimonitor this will give you much better graphical presentation and lists all the function parameters for that known API too. So more rich data to work with. As looking at long list is too overwhelming.
After you have found the APIs which look suspicious then you can get into a debugger and start investigating the usage of the API which comes a complexed field. You'll have to know how to software is expected to work for example.
Let's say you have a text editor just a simple notepad program you have downloaded.
You'll just review APIs for unusual activity such as:
- If you see network actvity on a simple text editor - Why does it need networking? Is it malicious related or just an auto patcher for self updating?
- If you see process modification external or internal - Why is it doing this? Review the related APIs to memory modifying
WriteProcessMemory or lower level API is
Though really you can't rely on just checking APIs as you can use
syscall directly which would bypass any listed APIs.
To determine malware you'll want to use things such as:
You'll want to get yourself varies tools such as:
- Virtual Machine (VMWare, Virtual PC or something similar). As you don't want to get your host machine infected with malware, do you? Though, do note that complexed malware can break out of virtual machines!
- Snapshot software to compare before and after execution of file system and registry. There is a good one developed by Microsoft. I'll dig it up for you when I'm at home. So, take snapshot before you run the application and after.
- Get yourself a debugger such as IDA PRO (ideally but very expensive) otherwise OllyDbg is my next favourite debugger.
Maybe I am getting off-topic? Anyway, I hope this information was useful. If so, I'll expand my answer.