Imports Reveal Capability

imphash: a hash of the ordered import table (DLL + function names).

Similar malware built from the same source tends to share an imphash —

handy for clustering and threat-intel pivots.

Caveat

Packed samples often import almost nothing (just

LoadLibrary/GetProcAddress) and resolve APIs at runtime —

a red flag by itself.