Import Address Table (IAT)
Definition
A section of the PE header that lists every external DLL and the functions the executable calls from each. A malware sample's IAT reveals its intended capabilities: calls to CreateRemoteThread suggest process injection; calls to CryptEncrypt suggest ransomware behaviour; calls to InternetOpen suggest network communication.
- Location
- PE header section
- Content
- External DLLs and called functions
- Signal example
- CreateRemoteThread suggests process injection
- Signal example 2
- CryptEncrypt suggests ransomware behaviour
Common questions
Why do some malware samples hide or obfuscate their IAT?+
Packers and obfuscators often resolve imports dynamically at runtime rather than listing them statically, which defeats simple IAT inspection and forces analysts toward dynamic or memory-based analysis to recover the true function calls.
Can the IAT alone confirm what a sample does?+
It only indicates capability, not confirmed behaviour, since a benign program can import the same functions as malware; analysts corroborate IAT findings with strings, control flow, and dynamic execution before concluding intent.
Related terms
- Cryptographic Hash
- A fixed-length digest produced from a file's bytes by an algorithm such as MD5 (128-bit), SHA-1 (160-bit), or SHA-256 (256-bit). Identical files...
- Disassembly
- The process of converting raw binary machine code back into human-readable assembly language instructions. Disassembly is always achievable from a binary, unlike...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Packer / Packing
- A technique in which the original malware code is compressed or encrypted and wrapped in a stub loader that decompresses or decrypts...
- Portable Executable (PE)
- The binary file format used by Windows executables (.exe), dynamic-link libraries (.dll), and drivers (.sys). The PE header contains a structured metadata...