A Windows sample has almost no imports and no suspicious API name strings. Does that mean it is harmless?
Short answer
No. A sparse import table proves nothing. Malware often stores hashes or other identifiers instead of API names and resolves them at runtime with GetProcAddress and LoadLibrary, which leaves no telltale strings or import entries for static analysis. MITRE ATT&CK tracks this as Dynamic API Resolution (T1027.007). Treat a near-empty import table, plus little readable text, as a red flag and move on to dynamic analysis or unpacking.
Static triage starts with the import table and strings: a program that imports CreateRemoteThread and VirtualAllocEx tells you something. Attackers know that, so the lack of such evidence is not evidence of safety.
What is happening
MITRE ATT&CK describes Dynamic API Resolution (T1027.007): instead of linking Windows functions normally, malware keeps hashes or other identifiers and, at runtime, uses them with GetProcAddress() and LoadLibrary() to reproduce the linking and loading process itself. The identifiers may even be encrypted and decoded only during execution. The result is a binary whose import address table and strings reveal very little until it runs.
How to respond
- Treat a tiny import table (often only
GetProcAddress/LoadLibraryor nothing) as a signal, not reassurance. - Pivot to dynamic analysis in an isolated lab, or to unpacking and debugging, to see the resolved functions.
- ATT&CK's detection notes point to sequences of
GetProcAddress/LoadLibrarycalls after memory allocation and manual mapping.
Why the distractors fail
Importing nothing does not stop a program from reaching APIs. Windows has no rule rejecting small import tables. And legitimate programs normally import what they use, so a bare table is unusual rather than normal.
What interviewers want
The reflex that absence of evidence in static output is not evidence of absence, plus the name of the technique.
Likely follow-ups
- How would you recover the API names behind a set of hashes during reverse engineering?
- Which dynamic-analysis signals reveal runtime API resolution?
- How does packing differ from API hashing, and can a sample use both?