Common API used in Malware

Networking

Raw Sockets	WinAPI Sockets
socket()	WSAStratup()
bind()	bind()
listen()	listen()
accept()	accept()
connect()	connect()
read()/recv()	recv()
write()	send()
shutdown()	WSACleanup()

Persistence

Registry	File	Service
RegCreateKeyEx()	GetTempPath()	OpenSCManager
RegOpenKeyEx()	CopyFile()	CreateService()
RegSetValueEx()	CreateFile()	StartServiceCtrlDispatcher()
RegDeleteKeyEx()	WriteFile()
RegGetValue()	ReadFile()

Encryption

Name

WinCrypt

CryptAcquireContext()

CryptGenKey()

CryptDeriveKey()

CryptDecrypt()

CryptReleaseContext()

Anti-Analysis/VM

Function Name	Assembly Instructions
IsDebuggerPresent()	CPUID()
GetSystemInfo()	IN()
GlobalMemoryStatusEx()
GetVersion()
CreateToolhelp32Snapshot [Check if a process is running]
CreateFileW/A [Check if a file exist]

Stealth

Name
VirtualAlloc	Alloc memory (packers)
VirtualProtect	Change memory permission (packer giving execution permission to a section)
ReadProcessMemory	Injection into external processes
WriteProcessMemoryA/W	Injection into external processes
NtWriteVirtualMemory
CreateRemoteThread	DLL/Process injection...
NtUnmapViewOfSection
QueueUserAPC
CreateProcessInternalA/W

Execution

Function Name

CreateProcessA/W

ShellExecute

WinExec

ResumeThread

NtResumeThread

Miscellaneous

• GetAsyncKeyState() -- Key logging

• SetWindowsHookEx -- Key logging

• GetForeGroundWindow -- Get running window name (or the website from a browser)

• LoadLibrary() -- Import library

• GetProcAddress() -- Import library

• CreateToolhelp32Snapshot() -- List running processes

• GetDC() -- Screenshot

• BitBlt() -- Screenshot

• InternetOpen(), InternetOpenUrl(), InternetReadFile(), InternetWriteFile() -- Access the Internet

• FindResource(), LoadResource(), LockResource() -- Access resources of the executable