It's very common in malware code to obscure the name of the libraries and the APIs that they are using to hide their functionality from static analysis using what's called dynamic API loading.
Dynamic API loading is supported by Windows (and other operating systems as well) using two very well-known APIs :
- LoadLibraryA: This API loads a dynamic link library into the virtual memory of the calling program and returns its address (variations include LoadLibraryW, LoadLibraryExA, and LoadLibraryExW).
- GetProcAddress: This API gets the address of an API given its name or the ordinal value and, the address of the library that contains this API.
By calling these two APIs, malware is able to access APIs that are not written in the import table and this way might be hidden from the eyes of the reverse engineer.
In some advanced malware, the malware author also hides the names of the libraries and the APIs using encryption or other obfuscation techniques, which will...
