Analysis of the Contents of Windows’ Portable Executables Import Tables to Look for Malware and Zero-day Opportunities
Abstract
Advanced Persistent Threats place some of their malware in the Windows file system and they also use zero-day exploits. In this paper a modified C++ program parses 32-bit binaries within the Windows file system for Import Table constituents for analysis. The analysis demonstrates that undocumented Microsoft routines are used and that there are Software Development Life Cycle issues in some executables which may be used for zero-day exploitation. Much of the work in support of this is done by using available software i.e. Living Off The Land.
Fields of Study & Subjects
Security and Verification in Computing
Advanced Malware Detection Techniques
Digital and Cyber Forensics
Publication details
- Journal / source
- Research Repository (University of Gloucestershire)
- Publication date
- 6 January 2026
- Language
- EN
- Document type
- Book