WINDOWS API
Reference guide for Windows API functions commonly encountered in malware analysis, covering kernel32.dll, ntdll.dll, and user32.dll function families.
Contents
The Windows API (Application Programming Interface) is simply the official set of functions that Microsoft provides so that programs (normal software and malware alike) can interact with the Windows operating system.
Think of it as the only legal way a program can ask Windows to do anything useful: create a file, start a process, open a network connection, press a key, hide a window, etc.
Every piece of Windows malware you will ever analyze uses the Windows API — there is no other way.
1. Where does the Windows API live?
| DLL (Dynamic Link Library) | What it contains – most important for malware |
|---|---|
| kernel32.dll | File, process, thread, memory, handles – the core |
| user32.dll | Windows, messages, keyboard/mouse, GUI stuff |
| advapi32.dll | Registry, services, privileges, crypto |
| ntdll.dll | Low-level NT system calls (the real kernel interface) |
| ws2_32.dll / wininet.dll | Network: sockets, HTTP, DNS |
| shell32.dll / shlwapi.dll | Shell operations, file shortcuts, URLs |
| ole32.dll / oleaut32.dll | COM, automation, often used for Office macros |
| winhttp.dll | Modern HTTPS (common in 2024–2025 malware) |
| crypt32.dll | Certificate functions (often abused) |
2. Two ways programs call the Windows API
| Method | What you see in static analysis | What you see when running |
|---|---|---|
| Dynamic linking (99% of normal programs & most malware) | Clear Import Address Table (IAT) with function names: CreateFileA, WriteProcessMemory, RegSetValueEx, etc. | Easy to see in ProcMon, API monitors |
| Dynamic / manual loading (common evasion technique) | No imported names, or only LoadLibrary + GetProcAddress | At runtime it loads the DLL and resolves functions manually → hides real API usage from static tools |
3. The Most Important Windows API Functions You Will See in Malware (2025 hit list)
| Category | API Function | What malware uses it for |
|---|---|---|
| Process Injection | VirtualAllocEx, WriteProcessMemory, CreateRemoteThread | Classic DLL/code injection |
| NtMapViewOfSection, NtCreateThreadEx (ntdll) | Stealthier injection (direct syscalls) | |
| Persistence | RegCreateKeyEx, RegSetValueEx | Writes to HKCU\Run, HKLM\Run, etc. |
| CreateService, StartService | Installs itself as service | |
| File Operations | CreateFile, WriteFile, CopyFile | Drops payload, ransomware encryption |
| URLDownloadToFile, WinHttpOpen | Downloads next stage | |
| Network | socket, connect, WSAConnect | Raw sockets (ws2_32) |
| InternetOpen, HttpOpenRequest | Old wininet style C2 | |
| WinHttpConnect, WinHttpSendRequest | Modern HTTPS C2 (2023–2025) | |
| Anti-Analysis | IsDebuggerPresent, CheckRemoteDebuggerPresent | Detects if being debugged |
| NtQueryInformationProcess | ProcessDebugPort, ProcessDebugObjectHandle | |
| GetTickCount, QueryPerformanceCounter → XOR check | Timing checks against sandboxes | |
| Privilege Escalation | LookupPrivilegeValue, AdjustTokenPrivileges | Enables SeDebugPrivilege, SeImpersonate, etc. |
| Evasion | LoadLibrary, GetProcAddress | Dynamic API resolution (hides real functions) |
| NtOpenProcess, NtReadVirtualMemory | Direct syscall versions (bypasses API hooks) | |
| Hiding | SetWindowsHookEx, RegisterHotKey | Keylogger or persistence |
| CreateMutex, OpenMutex | Singleton check (only one instance) |
4. How malware hides Windows API usage (2025 techniques)
| Technique | What it looks like in tools |
|---|---|
| Direct syscalls | Calls ntdll functions with syscall numbers instead of using kernel32 |
| API hashing | Hashes function names at runtime, resolves via GetProcAddress |
| String encryption | All API and DLL names are encrypted/obfuscated |
| Reflective DLL injection | No LoadLibrary on disk, everything in memory |
| Syscall stubbing | Malware contains its own syscall stubs (e.g., Tartarus Gate, SysWhispers) |
5. Quick cheat sheet for daily malware analysis
When you open a sample in PE-bear, x64dbg, or IDA, ask yourself these questions:
- Does it import suspicious APIs? → CreateRemoteThread + WriteProcessMemory = almost certainly injection
- Does it only import LoadLibrary + GetProcAddress? → It’s doing dynamic resolution (common evasion)
- Does it import a lot of Nt* functions from ntdll? → Probably doing direct syscalls to evade EDR hooks
- Does it import networking APIs but no URLs visible? → Domain generation algorithm (DGA) or encrypted config
- Does it import VirtualAlloc + CreateThread + WinHttp*? → Typical downloader → shellcode → next-stage pattern