Mapping APIs to Malicious Behavior
- Injection: allocate in remote process → write code → create thread.
- Persistence: Run keys, services, scheduled tasks, startup folder.
- C2 / exfiltration: HTTP/S, DNS, raw sockets; beacon loops.
- Crypto: key generation + bulk encrypt = ransomware pattern.
- Beware
GetProcAddress/LoadLibrary: malware hides real imports and resolves them at runtime.