How Runtime Linking and String Obfuscation Hide Imports from Static Analysis

Summary

A tutorial demonstrates how XOR-obfuscated strings and runtime linking with LoadLibrary and GetProcAddress can hide API names and imports from static analysis, while decoded strings and import-table inspection still provide clues.

Key points

The example resolves URLDownloadToFile and ShellExecute at runtime instead of listing them as ordinary linked imports.
It uses a simple XOR loop to obscure DLL and function-name strings, then decrypts them before calling LoadLibrary and GetProcAddress.
FLOSS may recover obscured strings as gibberish during static extraction, while decoded-string output can reveal the original content.
The dumpbin imports output lacks the two primary libraries handled through runtime linking, though other imports remain.
The presenter describes hidden strings and missing imports as clues to obfuscation or evasion, while noting that similar techniques can also appear in legitimate software.

Article Details

Topics: [00:00] Hiding imports and the effect on static analysis
[01:29] Loading libraries and resolving functions at runtime
[03:17] Obfuscated strings and FLOSS string recovery
[05:13] XOR obfuscation in malware and interpreting decoded strings
[06:20] Inspecting the import table with dumpbin
[07:19] Implications for malware evasion, red-team tools, and legitimate software

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe tutorial demonstrates obfuscating strings and hiding imports to make program capabilities less visible during static analysis.

People

Dr Josh StroscheinPresenter of the lesson explaining runtime linking, string obfuscation, and static-analysis indicators.

Tools

FLOSS[04:26] let's just do this and we'll do floss.