Malware API Reference

Primary Resource: https://malapi.io — Interactive Windows API reference organized by malware behavior categories.

---

1. What is MalAPI.io?

MalAPI.io is a curated database of Windows API functions commonly abused by malware, organized by ATT&CK technique categories. It maps each API to:

• What it does
• Which malware families use it
• What MITRE ATT&CK technique it corresponds to
• Example usage patterns

How to Use It

1. Go to https://malapi.io
2. Browse by category (Injection, Evasion, Persistence, etc.) or search a specific API name
3. Click any API to see: description, parameters, related malware, detection notes
4. Use it alongside your disassembler — when you see an unknown API in imports, look it up on MalAPI

---

2. API Categories & Key Functions

Process Injection APIs

API Function	Description	Risk Level
VirtualAllocEx	Allocate memory in another process	High
WriteProcessMemory	Write data into another process’s memory	Critical
CreateRemoteThread	Create a thread in another process	Critical
NtMapViewOfSection	Map a section object into a process (stealthy)	Critical
QueueUserAPC	Queue an APC to a thread (APC injection)	High
SetThreadContext	Modify thread registers (thread hijacking)	Critical
NtCreateThreadEx	Low-level thread creation (ntdll)	Critical
RtlCreateUserThread	Another thread creation (used to bypass hooks)	Critical

Memory Manipulation APIs

API Function	Description	Risk Level
VirtualAlloc	Allocate memory in current process	Medium
VirtualProtect	Change memory page protections (RWX)	High
HeapCreate / HeapAlloc	Heap allocation (shellcode staging)	Medium
NtAllocateVirtualMemory	Low-level memory allocation	High
VirtualFree	Free allocated memory	Low

Evasion & Anti-Analysis APIs

API Function	Description	What Malware Does
IsDebuggerPresent	Check if debugger attached	Exit or change behavior
CheckRemoteDebuggerPresent	Check for remote debugger	Same as above
NtQueryInformationProcess	Query debug port, flags	Detect debugger/sandbox
GetTickCount / QueryPerformanceCounter	Get system time	Timing-based sandbox detection
NtDelayExecution / Sleep	Delay execution	Sandbox evasion (sleep > analysis time)
OutputDebugStringA	Send string to debugger	Crash certain debuggers
NtSetInformationThread	Hide thread from debugger	ThreadHideFromDebugger
GetSystemInfo	Get CPU/RAM info	Detect VM (low resources = sandbox)
EnumWindows	List all windows	Check for analysis tools

Persistence APIs

API Function	Description	Persistence Method
RegCreateKeyExA	Create registry key	Run key persistence
RegSetValueExA	Set registry value	Write to HKCU\...\Run
CreateServiceA	Create a Windows service	Service persistence
StartServiceA	Start a service	Activate persistence
CopyFileA	Copy file to new location	Drop to startup folder
SHGetFolderPathA	Get special folder paths	Find Startup folder
CoCreateInstance	Create COM object	COM hijacking

File Operations APIs

API Function	Description	Malware Use
CreateFileA/W	Open/create file	Drop payloads
WriteFile	Write data to file	Write malicious content
ReadFile	Read file contents	Read config/steal data
DeleteFileA	Delete a file	Self-deletion, anti-forensics
MoveFileA	Move/rename file	Relocate payload
FindFirstFile / FindNextFile	Directory enumeration	Ransomware file discovery
GetTempPathA	Get temp directory	Common drop location

Network Communication APIs

API Function	Description	Protocol
WSAStartup	Initialize Winsock	Raw sockets
socket / connect / send / recv	Raw socket operations	TCP/UDP C2
InternetOpenA	Initialize WinINet	HTTP/HTTPS
InternetConnectA	Connect to server	HTTP C2
HttpOpenRequestA	Create HTTP request	HTTP C2
HttpSendRequestA	Send HTTP request	Exfiltration
WinHttpOpen	Initialize WinHTTP (modern)	HTTPS C2
URLDownloadToFileA	Download file from URL	Stage 2 download
InternetReadFile	Read response data	Receive C2 commands

Credential Theft APIs

API Function	Description	What It Steals
CredEnumerateA	Enumerate stored credentials	Windows credential store
CryptUnprotectData	Decrypt DPAPI-protected data	Browser passwords, cookies
LsaRetrievePrivateData	Retrieve LSA secrets	Service passwords
OpenProcessToken	Open process token	Token theft
DuplicateTokenEx	Duplicate access token	Token impersonation
ImpersonateLoggedOnUser	Impersonate user	Privilege escalation

Crypto APIs

API Function	Description	Malware Use
CryptAcquireContextA	Get crypto provider handle	Initialize encryption
CryptGenKey	Generate encryption key	Ransomware key gen
CryptEncrypt	Encrypt data	Ransomware file encryption
CryptDecrypt	Decrypt data	Decrypt config/C2 traffic
CryptImportKey	Import crypto key	Import attacker’s public key
BCryptEncrypt	Modern crypto (CNG)	Newer ransomware

---

3. API Resolution Techniques (How Malware Hides APIs)

Static Linking (Normal)

// Visible in Import Address Table
CreateRemoteThread(hProcess, NULL, 0, lpStartAddress, lpParameter, 0, NULL);

Detection: Clearly visible in IAT — easy to spot in PE-bear, IDA, Ghidra

Dynamic Resolution (Common Evasion)

// Only LoadLibrary + GetProcAddress visible in IAT
HMODULE hKernel = LoadLibrary("kernel32.dll");
typedef HANDLE (*pCreateRemoteThread)(...);
pCreateRemoteThread myFunc = (pCreateRemoteThread)GetProcAddress(hKernel, "CreateRemoteThread");
myFunc(hProcess, NULL, 0, lpStartAddress, lpParameter, 0, NULL);

Detection: Only see LoadLibrary + GetProcAddress in IAT — must trace runtime resolution

API Hashing (Advanced Evasion)

// No API names at all in the binary
DWORD hash = 0xAFC1B2D3;  // pre-computed hash of "CreateRemoteThread"
FARPROC func = resolve_api_by_hash(hash);  // walks PEB → DLL list → export table
func(hProcess, NULL, 0, lpStartAddress, lpParameter, 0, NULL);

Detection: No strings, no IAT entries — must reverse the hashing function. Common hash algorithms: djb2, ror13, crc32

Direct Syscalls (Most Advanced)

; Bypass all user-mode hooks entirely
mov r10, rcx
mov eax, 0x3F          ; NtCreateThreadEx syscall number
syscall

Detection: Look for syscall instructions with hardcoded syscall numbers. Tools: SysWhispers, HellsGate, Tartarus Gate

---

4. Quick Analysis Workflow Using MalAPI

1. Extract imports from binary (PE-bear, CFF Explorer, Ghidra)
2. For each suspicious import → search on malapi.io
3. Group imports by malware behavior category:
   □ Injection?  □ Persistence?  □ Network?
   □ Evasion?    □ File ops?     □ Crypto?
4. If only LoadLibrary + GetProcAddress → it's hiding real APIs
5. Cross-reference with strings analysis (FLOSS output)
6. Map to MITRE ATT&CK techniques
7. Write behavioral summary

---

5. Essential Online API Lookup Resources

Resource	URL	Use Case
MalAPI.io	malapi.io	Malware-focused API reference
MSDN	learn.microsoft.com	Official API documentation
Undocumented NtAPI	ntdoc.m417z.com	Undocumented ntdll functions
ReactOS Source	reactos.org	Open-source Windows API implementation
MITRE ATT&CK	attack.mitre.org	Map APIs to threat techniques
Unprotect.it	unprotect.it	Evasion & anti-analysis techniques