Procedure examples

AvosLocker has used obfuscated API calls that are retrieved by their checksums.

TONESHELL has utilized a modified DJB2 algorithm to resolve APIs.

CANONSTAGER has utilized custom API hashing to obfuscate the Windows APIs being used.

CLAIMLOADER has utilized XOR-encrypted API names and native APIs of `LdrLoadDll()` and `LderGetProcedureAddress()` to resolve imports dynamically.

HTTPTroy has utilized dynamic API resolution by reconstructing API calls during runtime using combinations of arithmetic and logical operations to complicate static analysis.

CHIMNEYSWEEP can use `LoadLibrary` and `GetProcAddress` to resolve Windows API function strings at run time.

Pteranodon can use a dynamic Windows hashing algorithm to map API components.

SplatDropper has leveraged hashed Windows API calls using a seed value of "131313".

PlugX has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.

Latrodectus can resolve Windows APIs dynamically by hash.

LODEINFO can use a hashing algorithm to dynamically resolve API function addresses.

LP-Notes has dynamically resolved API functions during the C runtime startup.

Bazar can hash then resolve API calls at runtime.

HiddenFace can dynamically resolve Windows APIs.

Samurai can encrypt API name strings with an XOR-based algorithm.

Raccoon Stealer dynamically links key WinApi functions during execution.

Brute Ratel C4 can call and dynamically resolve hashed APIs.